LESSON 2.3
Cross-site request forgery
Learn key techniques and workflows in Practical Web Security.
9m
intermediate
9,842 students
Overview
CSRF makes a logged-in user’s browser send a request they never intended. SameSite cookies and anti-forgery tokens close it.
In this lesson you will:
- Understand how an ambient credential is abused
- Set SameSite cookie attributes correctly
- Validate anti-forgery tokens on state-changing requests
Pro Tip
Use caching and revalidation wisely to ensure your app stays fast and data remains fresh without unnecessary requests.