Lesson 2.3

Cross-site request forgery

CSRF makes a logged-in user’s browser send a request they never intended. SameSite cookies and anti-forgery tokens close it.

10mIntermediate9.8k students

Overview

What this lesson covers

  • Understand how an ambient credential is abused
  • Set SameSite cookie attributes correctly
  • Validate anti-forgery tokens on state-changing requests

This lesson sits in Common Web Vulnerabilities, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.

In this lesson you will:

  • Understand how an ambient credential is abused
  • Set SameSite cookie attributes correctly
  • Validate anti-forgery tokens on state-changing requests

Resources

OWASP Top 10

The official reference for the tools used in this lesson.