Cross-Site Request Forgery (CSRF) Explained

Cross-site request forgery, aka CSRF, XSRF, one-click attacks or session riding attacks are attacks in where an attacker is able to convince your browser to send API requests as if they originated on your behalf. Cross-site request forgery (CSRF) is widespread, but in recent years it's popularity as an attack vector has dropped due to framework-level adoption of anti-CSRF tokens. In this video tutorial, learn how to make use of CSRF attacks - how to mitigate (protect against) CSRF attacks and also learn a few mitigations that look good in theory but don't actually protect against CSRF or have better CSRF protection alternatives.

[andrewkoontz]

I just want to say that as a student who is studying for their Cybersecurity degree your videos are invaluable. You are able to break down complex concepts in a very digestible manner and allow me to get a real understanding of what's going on under the hood. Thank you for your work!

[iamt_tl]

just want to point out something implied in the video,
CSRF on POST forms is as easy as creating a malicious page with a javascript that POST a crafted message to the vulnerable website where the victim is logged into.

CSRF is something which developers have the most responsibility to fix, mentioned in the video through a secret CSRF token.
Another method to mitigate (note the term, not fix) CSRF is through a fixed session invalidation duration. While this method is not user friendly, it does reduce the time window which the user will encounter the CSRF payload AND with a valid session token with the vulnerable website. Having a fixed expiration duration is recommended for other security mitigation measures as well.

Is there something users can do to prevent CSRF? 1. don't click on any unknown links. 2. log out of every services once you are done using them - if you do not maintain a session, chances are any decently coded website will reject the CSRF request (GET, POST, BLAH) before bothering to parse anything.