Weakness
Cross-site request forgery
CSRF
Tricking a logged-in user's browser into sending a request they never meant to make.
Browsers attach a site's cookies to requests even when another site triggers them. Without anti-CSRF tokens or same-site cookies, a malicious page can make a victim's browser change settings or transfer data on a site they are logged into.
Cross-site request forgery in the news
Recent stories that mention it.
The weakness behind it
Its CWE entry, with CVEs in the news, attacker techniques and the controls that stop it.
Related
Plain-language explainers written by SecurityTabs, matched to stories by name. All terms