Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) is an attack that exploits the trust a web application places in an authenticated user’s browser. When a user is logged into a vulnerable application, an attacker can craft a malicious page or email that triggers state-changing requests, such as password changes, fund transfers, or account modifications, using the victim’s active session. The browser automatically includes session cookies with every request to the target domain, so the application cannot distinguish between legitimate user-initiated actions and forged requests originating from an attacker-controlled page.

Why It Matters

CSRF attacks can have severe consequences despite their conceptual simplicity. In banking applications, CSRF has been used to initiate unauthorized wire transfers. In administrative interfaces, CSRF can create new admin accounts, change security settings, or disable logging. The attack is especially dangerous when combined with XSS, where stored XSS can deliver CSRF payloads to every user who visits a page. While modern frameworks often include CSRF token protection by default, developers frequently disable it for API endpoints, AJAX handlers, or specific routes under the assumption that they are not vulnerable, creating exploitable gaps.

For example, an attacker could host a page containing <img src="https://bank.com/transfer?to=attacker&amount=10000">. When an authenticated bank user visits this page, the browser sends the transfer request with the user’s session cookie, and the bank processes it as a legitimate transaction.

How Revaizor Handles This

Revaizor’s AI agents methodically audit every state-changing endpoint for CSRF protection. The platform validates the presence and enforcement of anti-CSRF tokens, checks SameSite cookie attributes, and tests whether CORS policies are properly configured. Revaizor goes beyond simple token presence checks by verifying that tokens are actually validated server-side, that they are tied to user sessions, and that they cannot be reused or predicted. The platform generates proof-of-concept HTML pages that demonstrate successful CSRF exploitation, providing development teams with immediately actionable evidence.