CSRF
Technology & Computing abbreviation · Cybersecurity
| Stands for | Cross-site request forgery |
|---|---|
| Categories | Technology & Computing |
CSRF stands for Cross-site request forgery, a cybersecurity abbreviation.
An attack that tricks a logged-in user's browser into sending an unwanted request to a site where they are authenticated, such as changing their email address or transferring money, because the browser automatically attaches their cookies.
Example: Every state-changing form includes a CSRF token, so forged requests from other sites are rejected.
Usage notes
Also called XSRF or "sea-surf". Defenses include anti-CSRF tokens, Origin header checks and SameSite cookies; Chrome began treating cookies as SameSite=Lax by default in 2020, greatly reducing the risk. Unlike XSS, CSRF does not need to inject code into the target site.
Related abbreviations
More cybersecurity abbreviations
- CERT – Computer Emergency Response Team
- CIA – Confidentiality, integrity, availability
- CISO – Chief information security officer
- CISSP – Certified Information Systems Security Professional
- CSPM – Cloud security posture management
- CSR – Certificate signing request
- CTF – Capture the flag
- CVE – Common Vulnerabilities and Exposures
- CVSS – Common Vulnerability Scoring System
- CWE – Common Weakness Enumeration
- DAC – Discretionary access control
- DAST – Dynamic application security testing