CSRF Vulnerability Explained

What is CSRF?#

CSRF (Cross-Site Request Forgery) is a web security vulnerability that allows an attacker to trick a logged-in user into performing an unwanted action on a web application in which they are authenticated.

In simple terms: the attacker abuses the fact that the user is already logged in (has a valid session cookie) to perform actions on their behalf without their knowledge.

Bdarija : CSRF katkhlli attacker ydir actions f site f blassa dyal user, bla ma user ykon 3arf. donc attacker kaystaghll session/cookie dyal user (li logged in) bach ysendi requests l site b7al ila howa.#

Real Scenario Example (Old password = hamza123)#

• Hamza is a legitimate user, logged into target.com
• target.com has a password change form like this:

<form action="https://target.com/change-password" method="POST">
  <input name="old" value="">
  <input name="new" value="">
  <input name="confirm" value="">
</form>

• Anas (attacker) knows the old password (e.g., hamza123) and creates a malicious page on attacker.com:

Possible Anas changing the password without knowing the old password, if the website don't requere the old password aslan

<html>
  <body onload="document.forms[0].submit()">
    <form action="https://target.com/change-password" method="POST">
      <input type="hidden" name="old" value="hamza123">
      <input type="hidden" name="new" value="hackedByAnas">
      <input type="hidden" name="confirm" value="hackedByAnas">
    </form>
  </body>
</html>

• When Hamza visits attacker.com, the form is auto-submitted.
• His browser includes the session cookie, and the server (target.com) sees it as a valid request.
• ➜ Password is changed without Hamza knowing.

Exemple :#

What If Attacker Does NOT Know the Old Password?#

If target.com does not ask for the old password during a password change, then:

• CSRF is even easier to exploit.
• The attacker just submits a new password and confirmation (no need for current one).

!!! How to Protect Against CSRF !!!#

1. CSRF Token#

Generate a random token for each user session, include it in every form:

<input type="hidden" name="csrf_token" value="XYZ123...">

On the server side:

if request.form['csrf_token'] != session['csrf_token']:
    return 403

!!!!!!!!!!!!!!!!!!!!!!!!Even if you're using a CSRF token, it can be vulnerable if it's static, predictable, not properly validated on the server (e.g., wrapped in a generic try/catch), or if developers store it in cookies · which are sent automatically with every request and provide no CSRF protection. Also, relying solely on headers like Referer can be risky, since they can be spoofed.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#

2. SameSite Cookie Attribute#

Prevents browsers from sending cookies in cross-site requests:

Set-Cookie: sessionid=abc123; SameSite=Strict

• Strict: cookies not sent with cross-site requests.
• Lax: semi-restricted.

3. SOP + CORS#

• SOP (Same-Origin Policy): blocks JS from reading data from different origins.
• CORS (Cross-Origin Resource Sharing): explicitly define allowed origins:

Access-Control-Allow-Origin: https://yourdomain.com

!!!!! Never use * for sensitive endpoints.!!!!!!!!!!

4. JWT + Double Submit Cookie#

Send JWT in both cookie and request body:

• Frontend sends:
  • Cookie: jwt_token=abc123
  • Body: { csrf_token: abc123 }
• Server compares the two values.

5. Referer Header Validation#

Referer: https://target.com/profile

Check that the request comes from a valid page on your own site.

6. CAPTCHA#

Add CAPTCHA to sensitive forms to prevent auto-submission.

7. Avoid GET for Sensitive Actions#

Never use GET for actions that modify data.

• Use POST, PUT, or DELETE.

8. Rate Limiting#

Prevent brute force CSRF or abuse by limiting number of requests:

• Use tools like fail2ban or WAFs.

How to Detect Possible CSRF in a Site#

Indicators:#

• Site performs state-changing actions via GET requests
• No CSRF tokens in forms
• No SameSite in cookies
• Referer not validated
• Request can be repeated from external origin and works

Tools for Testing:#

• Manual inspection (DevTools ---> Inspecter ---> Network)
• Burp Suite (Repeater + Intruder) Right-click 3la request → Engagement tools → Generate CSRF PoC
• OWASP ZAP

Summary Table#

Always combine multiple techniques to protect your web app from CSRF attacks!