Cross-site request forgery

The XSS attack tricks the browser in running the script and performs an unwanted action on behalf of the innocent victim; the cross-site request forgery attack (CSRF) is a similar sort of flaw where the attacker makes the innocent victim perform some action but without the use of the script. The target of the malicious action is the web application in which the victim is currently authenticated.

Although CSRF and XSS seem similar, there are some distinct differences. In a CSRF flaw, the attacker takes over the identity of the victim and performs actions on their behalf. The CSRF attack is often used to change the details of the user on the vulnerable website such as email address, phone number, and address.

Note

Cross-site request forgery attack is also known as one-click or session riding attack.

Here's a simple example:

1. Attacker identifies a direct link on a vulnerable bank application to transfer money as follows:

   http://vulnerablebank.com/transfer.do?acct=ROGER...