CSRF and CORS Explained

This video briefly explains concepts around Cross-Site Request Forgery (CSRF), the web's Same-Origin Policy, and Cross Origin Resource Sharing (CORS) through examples and illustrations.

CSRF and CORS are two common vulnerabilities that allow attackers to inject malicious code into your website. This code can then be used to steal your login credentials or access sensitive data on your website.

In this video, we'll explain how CSRF and CORS work and how to protect yourself from these vulnerabilities. We'll also overview some common attacks that use these vulnerabilities and how to prevent them. So don't wait – watch this video and learn how to protect yourself from CSRF and CORS attacks!

What thoughts do you have? Leave us a comment and subscribe!

Chapters
00:00 Intro
00:40 What is Cross-Site Request Forgery (CSRF)?
01:24 The Same-Origin Policy
02:12 What is an "Origin"?
02:45 Cross Origin Resource Sharing (CORS)
05:43 Is Cross-Site Request Forgery (CSRF) still an issue?
06:08 Mitigation Steps Against Cross-Site Request Forgery (CSRF)
07:49 Conclusion

[unnaipoloruvan]

Thanks bro...its easier to grasp the basics

[marksaravi]

Good speaker and clear explanation. You are a start!

[bbstriker]

That was a great and very articulate description. Thank you

[favouritejome]

All this time I never really made effort knowing more about CORS, anytime I encounter the CORS warning I just say hey, backend guy, I'm getting a CORS error, fix it 😂. It's great learning about it, so thanks for making this video. Also taking about Cross Site Request Forgery . which is my first time hearing or knowing about it.

[ejborba]

Great content mate! Really enlightening, keep up the good work!

[premaseemjain]

Thanks for explaining this Dude. It totally makes sense.

[anuonline]

No better explanation needed buddy.. This is great 👍😊

[briansans-souci]

Great explanation man!!!! Thanks from Mauritus!

[abhijithsj]

For CSRF implementation, For each Request, we need to call get CSRF token and then execute core action call along with return token?
In terms of performance Do we have any other option? Because currently, each core method call will be 2 network call ?

[gaurabsarkar]

Can you please talk about CSR vs SSR whenever convenient 🙌

[shreshthmohan]

This is going to be a meme! Sorry Tejas. 2:26

[MarinaMarina-frex]

I was struggling to understand these concepts, and now that I finally understood, I think that your explanation is not right. Same origin policy (SOP) or CORS may prevent other sites to open page with content, actually to read response...but it does not prevent sending request. So that is why CORS does not save us from CSRF because if someone wants to perform attack he is interested only in post request.

[lifeofsq]

CORS and CSRF are different, CORS do not protect against CSRF, Origin and sites are totally different concepts bro. Even with all cors protection in place csrf attacks are still prevalant