Issue Details
Cross Site Request Forgery (CSRF)
Aliases: None
Explanation
In OWASP 2007, A5 Cross Site Request Forgery (CSRF) combines related risk themes across Cross-Site Request Forgery (CSRF). CSRF abuses a victim's active session by causing their browser to submit a forged state-changing request with valid cookies, client certificates, or cached credentials still attached. In practice, attackers embed hidden forms, image tags, or scripted requests that trigger actions such as changing account details, initiating transactions, creating privileged users, or altering security settings without the victim realizing it. The risk grows when applications rely only on session cookies, allow predictable workflows, or expose sensitive actions without explicit re-verification of user intent. Operationally, CSRF can lead to fraudulent transactions, administrative takeover, audit trail confusion, and costly incident response because the requests appear to come from legitimate users rather than clearly malicious actors.
Remedy
For OWASP 2007 A5 Cross Site Request Forgery (CSRF), apply defense in depth across design, implementation, deployment, and operations rather than relying on a single control. Priority controls include: Require anti-CSRF tokens on every state-changing request, bind them to the user session, and validate them server-side with strict expiration and rotation rules. Use SameSite cookies, verify Origin and Referer headers where appropriate, and require step-up authentication or explicit confirmation for high-risk actions such as payment changes or privilege updates. Avoid side effects on GET requests, require custom headers for browser-based API actions when feasible, and ensure logout, password reset, and profile management flows are covered by the same protection model. Treat mitigation as a continuous program: define security requirements up front, add automated CSRF regression tests, review framework defaults during upgrades, and monitor for unusual state-changing patterns that could indicate forged request campaigns.
| Year | Rank | Category |
|---|---|---|
| 2007 | #5 | A5 - Cross Site Request Forgery (CSRF) |
| 2010 | #5 | A5 - Cross-Site Request Forgery (CSRF) |