From the course: ASP.NET: Security

Unlock the full course today

Join today to access over 24,800 courses taught by industry experts.

Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF)

From the course: ASP.NET: Security

Start my 1-month free trial Buy for my team

Cross-Site Request Forgery (CSRF)

“

- [Tutor] The final attack I would like to cover in this chapter is Cross-Site Request Forgery, or in short CSRF. Some people use XSRF as the abbreviation but CSRF is just more common, so I'll stick with that. There're different approaches to Cross-Site Request Forgery but I'll show you the most common one. The idea is that the victim is authenticated with a web application and the web application is using a cookie-based authentication meaning that every HTTP request comes with the cookie. And based on the cookie, the application authenticates and also authorizes the user. And this could be abused in the following fashion. The attacker somehow lures the victim to make an HTTP request to their site. So an HTTP request is being sent to the attacker's server and the attacker returns an HTTP response that in turn triggers a new HTTP request. For instance by doing redirection or with some JavaScript code that does…

Contents