CSRF (Cross-Site Request Forgery)

An attack that tricks a logged-in user's browser into making an unwanted request to your app — exploiting the fact that browsers automatically attach cookies to requests.

Example: An image tag on a malicious site that fires a DELETE request to your bank's API using the user's active session.

In practice: CSRF tokens, SameSite cookie attributes, and checking the Origin header are the standard defenses — the attack vector is nearly irrelevant for APIs that require an Authorization header, since scripts can't attach those cross-origin.

• often confused with XSS (Cross-Site Scripting)