Imagine logging into your banking application, then opening another website in a different tab.

Without your knowledge, that website triggers a request to your banking application to perform an action you never authorized.

You didn't initiate the action, but your browser may still send your authentication cookies with the request.

That's the idea behind Cross-Site Request Forgery (CSRF) .

What Is CSRF?

Cross-Site Request Forgery is a web security vulnerability that tricks a user's browser into performing unwanted actions on a website where the user is already authenticated.

The attacker doesn't necessarily need to steal your password or session cookie.

Instead, they exploit the trust between your browser and the application.

The problem isn't that the application doesn't recognize the user.…