"This server is vulnerable to a cross-site request forgery attack. Append each request with CSRF token or SameSite cookie attribute."
A cross-site request forgery (CSRF) is an attack that instigates the user to unintentionally send a request to a web application against which it is authenticated. CSRF attacks exploit the trust a web application has in an authenticated user.
CSRF attacks are often targeted, using social engineering, such as:
When a user logs in to a web application, the attacker prompts them to click a URL containing an unauthorized request for a specific web application. The user’s browser then sends this maliciously crafted request to a targeted web application, including session information such as session cookies or stored credentials. If the user is in active session with a targeted web application, the application will process this new request as an authorized user-initiated request. Consequently, allow the attacker to exploit the CSRF vulnerability of the web application.
The level of the attack depends on the level of privileges that the victim possesses. CSRF attack does not directly steal the users’ identity, instead, it exploits the user to carry out actions without their will.
A successful CSRF attack force user to perform the state-changing request, such as:
To prevent a CSRF attack:
Older browsers may fail to support the recently introduced SameSite cookie.