Understanding CSRF Attacks and How to Prevent Them

CSRF Principle

CSRF (Cross‑site request forgery) attacks trick an authenticated user into performing actions that the attacker wants.

Example

1. The user is logged into an admin backend.

2. The attacker creates a page containing a form that mimics the admin's "add administrator" operation.

3. The attacker sends the link to the user; if the user clicks, the forged request is submitted and the attacker can log in as the newly created admin and perform any operation.

The same technique can be used to delete users, delete articles, add articles, or perform any action the attacker knows about.

CSRF Prevention Measures

Two main defenses: CAPTCHAs and tokens.

CAPTCHA

Adding a CAPTCHA to sensitive backend pages forces a human to enter a code, preventing automated forged submissions, though it adds slight inconvenience.

Token

When the operation page loads, the server generates a dynamic token and stores a copy. The form includes the token in a hidden field. Upon submission, the server compares the received token with the stored one; mismatches abort the request. Because the token is unpredictable, attackers cannot craft a valid request.