🎣 Cross-Site Request Forgery (CSRF) Attack Flow
Forcing Authenticated Users to Execute Unwanted Actions
flowchart TD
A[👥 Victim User] -->|1. Authenticated session| B[🌐 Legitimate Website]
B -->|2. Session cookie stored| C[🍪 Browser Cookies]
A -->|3. Visits attacker site| D[🕷️ Malicious Website]
D -->|4. Embedded malicious form| E[📝 Hidden Form/Request]
E -->|5. Auto-submit to victim site| F[📤 Forged Request]
F -->|6. Include session cookies| C
C -->|7. Send with credentials| B
B -->|8. No CSRF validation| G[❌ Missing CSRF Token]
G -->|9. Execute action| H[💥 Unauthorized Action]
H -->|10. Transfer funds| I[💰 Money Transfer]
H -->|11. Change password| J[🔑 Account Takeover]
H -->|12. Update email| K[📧 Email Change]
I -->|13. Attacker benefits| D
J -->|14. Attacker gains access| D
K -->|15. Attacker controls account| D
style A fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000
style B fill:#ffd43b,stroke:#f59e0b,stroke-width:2px,color:#000
style C fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style D fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style E fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style F fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style G fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style H fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style I fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style J fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style K fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
L[🔒 Defense:
CSRF Tokens] -.->|Validate token| G
M[🛡️ Defense:
SameSite Cookies] -.->|Block cross-site| C
N[⚙️ Defense:
Origin Validation] -.->|Check origin header| F
style L fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style M fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style N fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
📋 Attack Flow Breakdown
1
Victim Authentication: User logs into vulnerable website.
bank.com - User authenticated, session cookie set
2
Malicious Form Injection: Attacker creates page with hidden form.
<form action="https://bank.com/transfer" method="POST">
<input name="to" value="attacker_account">
<input name="amount" value="10000">
</form><script>document.forms[0].submit();</script>
3
Image Tag Exploit (GET requests):
<img src="https://bank.com/transfer?to=attacker&amount=1000">
4
AJAX Attack:
fetch('https://bank.com/api/password', {
method: 'POST', credentials: 'include',
body: JSON.stringify({password: 'hacked123'})
})
5
Social Engineering: Trick victim into clicking malicious link.
Email: "Click here to claim your prize!" → CSRF payload
6
State-Changing Actions: Target sensitive operations.
Money transfers, password changes, email updates, account deletion
🛡️ Defense Mechanisms
✅ CSRF Tokens (Synchronizer Token Pattern):
Generate unique, unpredictable token per session/request.
<input type="hidden" name="csrf_token" value="abc123xyz">
Server validates token matches session
✅ SameSite Cookie Attribute:
Prevent cookies from being sent with cross-site requests.
Set-Cookie: session=abc; SameSite=Strict
Strict: Block all cross-site | Lax: Allow safe GET
✅ Double Submit Cookie:
Store CSRF token in both cookie and request parameter.
Cookie: csrf_token=abc123 | Body: csrf_token=abc123
✅ Origin/Referer Header Validation:
Check request origin matches expected domain.
if (origin !== 'https://bank.com') reject();
✅ Custom Request Headers:
Require custom headers that can't be set cross-origin.
X-Requested-With: XMLHttpRequest
✅ Re-authentication for Sensitive Actions:
Require password confirmation for critical operations.
Money transfers, password changes → Re-enter password
✅ Use Framework Protection:
Modern frameworks have built-in CSRF protection.
Django: {% csrf_token %} | Express: csurf middleware