What is cross-site request forgery?

Cross-Site Request Forgery (CSRF) is a type of web security vulnerability that allows an attacker to induce users to perform actions that they do not intend to perform. In a CSRF attack, an attacker tricks a victim into submitting a malicious request to a web application that the victim is currently authenticated with. Because the request appears to come from the authenticated user, the application cannot distinguish between a legitimate request and a forged one. CSRF attacks often target state-changing requests, not data theft, since the attacker cannot see the response to the forged request. Common mitigations involve using anti-CSRF tokens or employing SameSite cookies.