How CSRF Attacks Exploit Authenticated Sessions

Cross-Site Request Forgery (CSRF) tricks an authenticated user into unknowingly executing unwanted actions on a web application. In a typical scenario, a user is logged into a banking site in one tab while visiting a malicious page in another. The malicious page triggers a transfer request using the user's valid session, and the transaction completes without any user interaction or consent.

The attack follows a consistent pattern:

  • Target identification: The attacker locates a site where important actions are triggered by predictable URLs or request patterns.
  • Malicious request construction: The attacker crafts a request that mimics a legitimate action, such as bank.com/transfer?amount=1000&toAccount=attackerAccountId.
  • Victim deception: The attacker embeds the crafted request in a link or an HTML element that executes automatically, such as an image tag: <img src="bank.com/transfer?amount=100&to=AttackerAccount" />.
  • Request execution: When the victim loads the malicious page, the browser sends the request along with the user's cookies. The server accepts it because the session is valid.

The Threat Level of CSRF

CSRF is especially dangerous because it leverages legitimate, authenticated sessions, making the forged requests appear authentic to the server. The attack requires no user interaction beyond visiting a page or clicking a link, and the resulting actions can be difficult to distinguish from legitimate user behavior.

Effective CSRF Defenses for Developers

Anti-CSRF Tokens

Tokens are one of the most reliable protections against CSRF. The server issues a unique, unpredictable token per user session or form and validates it for any state-changing request.

  1. Generation: Upon login, the server generates a random session-specific token.
  2. Delivery: The token is sent to the browser, typically embedded in a hidden form field, cookie, or local storage.
  3. Inclusion: Any request that modifies data must carry the token.
  4. Validation: The server compares the submitted token with the session record. Mismatches or missing tokens cause the request to be rejected.
  5. Expiration: Tokens often have a short validity period, limiting the usefulness of a stolen token to a very narrow window.

Tokens should be regenerated for each form load and verified server-side upon submission. Because attackers cannot predict token values, crafting a valid forged request becomes impractical.

Modern browsers support the SameSite cookie attribute, which instructs the browser to withhold cookies on cross-site requests. This attribute provides strong protection by preventing the browser from attaching session credentials to requests originating from other domains.

Referer Header Inspection

Servers can check the Referer header of incoming requests to confirm they were initiated from a page on the same trusted origin. Requests with missing or cross-origin referrers can be flagged or rejected.

HTTP Method Discipline: GET vs. POST

Using the correct HTTP method for state-changing operations is a fundamental and often overlooked defense layer.

GET is meant solely for data retrieval and is expected to be idempotent — making the same request repeatedly must produce no side effects. In contrast, POST is designed to submit data for processing, such as creating an account or making a purchase, and may alter server state.

Avoiding GET for actions matters because:

  • Predictability: Actions baked into a GET URL are trivial to replicate in malicious links.
  • User deception: Tricking a user into clicking a link is far easier than convincing them to submit a form for a POST request.
  • Browser history: GET URLs and their parameters persist in browser history. Revisiting such a URL could unintentionally repeat a state-changing action.

Using POST for mutations offers concrete advantages: a user cannot be forced into a POST request by simply clicking a link, and forms naturally allow the embedding of anti-CSRF tokens. Together, method discipline and token validation produce a secure and predictable interaction model.