Cross-Site Request Forgery tricks a logged-in user's browser into submitting unwanted requests to your site.
Example
Malicious page: <img src="https://bank.com/transfer?to=attacker&amount=1000"> if cookies send automatically.
Defenses
- CSRF tokens tied to session
SameSitecookies- Require re-auth for sensitive actions
Important interview questions and answers
- Q: CSRF vs XSS?
A: XSS runs script; CSRF abuses existing session from another site. - Q: SameSite=Strict?
A: Cookie not sent on cross-site requests.
Self-check
- What does CSRF exploit?
- Name two defenses.
Tip: Framework CSRF middleware ON—do not disable without replacement.
Interview prep
- CSRF token?
Secret form value attacker cannot guess cross-site.