Cross-site request forgery
Cross-site request forgery is a web attack that induces an authenticated user’s browser to submit an unintended request to a trusted application.
ASP.NET Core in Action, 3e
Cross-site request forgery (CSRF) is an attack in which a victim's authenticated browser is induced to submit an unintended request to a trusted application.
- How it is used
- Protects cookie-authenticated Razor Pages and APIs from requests forged by a malicious website.
- How deep it goes
- Works through a forged banking POST and token-pair validation, including automatic framework behavior and opt-outs.
- Examples
- Uses a forged bank transfer and a rendered form’s __RequestVerificationToken hidden input.
- What you can do after
- Apply it via Razor Pages’ automatic antiforgery tokens and validation while avoiding unnecessary opt-outs.
Read how ASP.NET Core in Action, 3e explains cross-site request forgery →
Spring Security in Action, Second Edition
Cross-site request forgery is an attack that causes a user's authenticated browser to send an unintended state-changing request to a web application.
- How it is used
- Protects authenticated web applications from forged state-changing requests and explains when Spring Security's default protection applies.
- How deep it goes
- Explains the attack, token flow, filter integration, request testing, and extension contracts, while stopping short of broader attack theory.
- Examples
- Uses a file-management attack scenario, a Spring REST /hello endpoint, custom token logging, and curl requests.
- What you can do after
- Operate/configure Spring Security protection, test token-protected POST requests, and customize token handling through named contracts.
Read how Spring Security in Action, Second Edition explains cross-site request forgery →
Grokking Web Application Security
Cross-site request forgery is a web attack that causes a user's browser to send an unintended authenticated request to a site.
- How it is used
- Frames CSRF as a browser-based threat to authenticated user actions and a reason to protect state-changing endpoints.
- How deep it goes
- Explains CSRF through a GET comment-worm scenario and gives practical defenses, without detailing antiforgery-token implementation.
- Examples
- Uses a baking-forum GET comment form, a shortened redirect link, a self-replicating worm, and sensitive actions such as payments and deletions.
- What you can do after
- Apply it by keeping GET side-effect-free, using antiforgery tokens, and setting SameSite on sensitive cookies.
Read how Grokking Web Application Security explains cross-site request forgery →
Django in Action
Cross-site request forgery is a web attack that tricks an authenticated user’s browser into submitting an unintended state-changing request to a site.
- How it is used
- Protects Django forms that submit user actions, especially state-changing POST requests.
- How deep it goes
- Explains the attack, token flow, middleware check, and rejection condition without detailing middleware internals.
- Examples
- Uses a malicious comment-like form whose hidden fields secretly request a password change.
- What you can do after
- Apply it via Django’s {% csrf_token %} tag so submitted forms carry a value Django can validate.
Read how Django in Action explains cross-site request forgery →
Secure APIs
Cross-site request forgery is an attack in which a victim's authenticated browser is induced to send an unintended request.
- How it is used
- Protects OAuth authorization flows from malicious requests that exploit an authenticated identity-provider session.
- How deep it goes
- Traces the attack through authorization, redirection, and token exchange, then gives state and redirect-URI mitigations.
- Examples
- Uses malicious links, authorization URLs, active IdP sessions, redirect URIs, authorization codes, and access-token exchanges.
- What you can do after
- Apply state validation and constrained redirect URIs to reduce authorization-code and access-token hijacking.
Related concepts
- CSRF tokenaddressed by · A CSRF token is an unpredictable server-issued value required on state-changing requests to verify that they originated from the intended application.
- state parameteraddressed by · A state parameter is an opaque client-generated value carried through an authorization exchange to bind the response to its initiating request and help prevent request forgery.
- csrf protectionaddresses · CSRF protection is a web security mechanism that prevents forged state-changing requests from an authenticated user's browser from being accepted.
- vulnerabilitykind of · A vulnerability is a weakness or susceptibility in a system, process, or person that can expose it to harm, misuse, failure, or compromise.
- Spring Securityconfigured by · Spring Security is a Spring framework for implementing application authentication, authorization, access control, and protection against common security threats.
- cross-site request forgery protectionaddressed by · Cross-site request forgery protection is a web-security technique that prevents unauthorized requests made on behalf of an authenticated user.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.