Definition
Cross-site request forgery, or CSRF, is a type of web security vulnerability that tricks a user's web browser into executing unwanted actions on a trusted site. An attacker crafts a malicious link or embeds it in content that a victim might click, causing the victim's browser to send an authenticated request to a vulnerable web application without their knowledge. This can lead to unauthorized actions like changing passwords, making purchases, or transferring funds. For instance, a user might receive an email with a link that, when clicked, secretly transfers money from their bank account. CSRF differs from cross-site scripting (XSS) in that CSRF exploits the trust a site has in a user's browser, whereas XSS exploits a site's trust in user input. Understanding CSRF is crucial for cybersecurity professionals and is a common topic on exams like CompTIA Security+ and CySA+.