Simple definition
Cross-site request forgery tricks a signed-in browser into performing an unwanted action on a trusted site.
Purpose and use
CSRF, Cross-Site Request Forgery, exploits authentication automatically attached by a browser to trigger an action the user did not intend.
How does it work?
Cookie-based sessions are particularly relevant when the server requires no additional proof of the operation's origin or intent.
Example and verification
During review, verify framework defenses, CSRF tokens and origin checks on state-changing operations.
Points to watch
Using POST or enabling CORS alone does not eliminate the risk. SameSite provides additional protection with context-dependent limitations.
In short
Defense must verify authorization and whether a request is expected, rather than trusting session-cookie presence alone.