Cross-site request forgery
lastmod 2025-03-06created 2021-02-063 edits
Cross-site request forgery (CSRF, XSRF) is a type of website exploit: an attack that makes a user, regardless of their own will, send a request for an action intended by the attacker (modification, deletion, registration, etc.) to a specific website.
It is one of the attack methods used in the personal information leak incident at Auction, a well-known auction site.
Whereas an attack using cross-site scripting (XSS) targets the user's trust in a specific website, cross-site request forgery targets the state in which a specific website trusts the user's web browser. Once the user, while logged in to a website, opens a page into which cross-site request forgery attack code has been inserted, the target website judges that the forged attack command was sent by a trusted user, and is thus exposed to the attack.
See also
- Hacking
- Vulnerability
- Information Security
- Internet security
- Web Hacking
- Cross-Site Request Forgery (CSRF)
- Cross-Origin Resource Sharing (CORS)