Cross-Site Request Forgery (CSRF)

What it is

CWE-352 occurs when a web application accepts state-changing requests from a user without verifying that the user actually intended to make the request. An attacker hosts a page that issues a request to the target site; if the victim is authenticated and the target site does not check origin, referrer, or a CSRF token, the request executes with the victim's credentials.

Why it matters

CSRF is one of the longest-standing entries in the OWASP Top 10 (most recently consolidated under A01:2021 Broken Access Control). Successful exploitation lets an attacker transfer funds, change passwords, add admin users, post content, or trigger any other state change the victim is authorized to perform. Modern browsers ship SameSite=Lax cookies by default, which mitigates many cross-origin POST attacks, but GET-based state changes and same-site iframes remain exploitable when CSRF tokens are missing.

Common patterns

• •State-changing endpoints (POST, PUT, DELETE, PATCH) without CSRF token validation.
• •Cookies issued without the SameSite attribute, or with SameSite=None and no Secure flag.
• •Endpoints that perform state changes on GET (a CWE-650 overlap).
• •Custom session middleware that forgets to verify a per-session CSRF token.
• •API endpoints that authenticate via cookies but accept cross-origin requests via permissive CORS.

Languages affected

Example

import express from 'express'
import session from 'express-session'

const app = express()
app.use(session({ secret: 'k', resave: false, saveUninitialized: false }))

app.post('/account/email', (req, res) => {
  req.session.user.email = req.body.email
  res.json({ ok: true })
})

import express from 'express'
import session from 'express-session'
import csurf from 'csurf'

const app = express()
app.use(session({
  secret: 'k',
  resave: false,
  saveUninitialized: false,
  cookie: { sameSite: 'lax', secure: true, httpOnly: true },
}))
app.use(csurf())

app.get('/csrf-token', (req, res) => {
  res.json({ token: req.csrfToken() })
})

app.post('/account/email', (req, res) => {
  // csurf middleware already validated req.body._csrf
  req.session.user.email = req.body.email
  res.json({ ok: true })
})

Where this fits in OWASP Top 10

Compliance framework mapping

Related CWEs