{
  "slug": "cross-site-request-forgery",
  "url": "https://library.infinity8labs.com/cross-site-request-forgery/",
  "title": "Cross-site request forgery (CSRF)",
  "short": "CSRF",
  "aliases": [
    "Session riding",
    "One-click attack",
    "Cross-site request forgery"
  ],
  "summary": "CSRF tricks a signed-in user's browser into submitting an unwanted request with that user's cookies. It can change account settings, initiate transactions, or perform administrative actions without the user's informed approval.",
  "cwe": [
    "CWE-352"
  ],
  "owasp": "A01:2021 Broken Access Control",
  "typical_severity": {
    "min": "medium",
    "max": "high"
  },
  "updated": "2026-10-15",
  "references": [
    {
      "title": "CWE-352: Cross-Site Request Forgery",
      "url": "https://cwe.mitre.org/data/definitions/352.html"
    },
    {
      "title": "OWASP Cross-Site Request Forgery Prevention Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"
    },
    {
      "title": "OWASP Top 10 A01:2021 Broken Access Control",
      "url": "https://owasp.org/Top10/A01_2021-Broken_Access_Control/"
    },
    {
      "title": "PortSwigger Web Security Academy: CSRF",
      "url": "https://portswigger.net/web-security/csrf"
    }
  ],
  "sections": [
    "https://library.infinity8labs.com/cross-site-request-forgery/#overview",
    "https://library.infinity8labs.com/cross-site-request-forgery/#impact",
    "https://library.infinity8labs.com/cross-site-request-forgery/#examples",
    "https://library.infinity8labs.com/cross-site-request-forgery/#remediation",
    "https://library.infinity8labs.com/cross-site-request-forgery/#testing",
    "https://library.infinity8labs.com/cross-site-request-forgery/#references"
  ]
}