Cross-site request forgery
Summary: PortSwigger's research explains that cross-site request forgery arises when an application relies solely on HTTP cookies to identify the user who issued a request, since browsers attach cookies to requests regardless of origin and an attacker can build a malicious site that forges a cross-domain request. It states the most effective defense is an additional token not sent in a cookie, such as a hidden form field parameter, generated with a cryptographic random number generator, tied to the user's session, and validated before any action is performed.
Key Takeaway: The fallback defense of checking that Host and Referer headers are present and share the same domain is described as less robust, because browser and plugin quirks have historically let attackers forge cross-domain requests that manipulate those headers and bypass it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026