Csrf

Comprehensive CSRF Guide 🆕 Updated September 12, 2026 — added the NASA AIT-GUI command-bus CSRF chain and a reminder that simple content types skip preflight entirely. A practitioner’s reference for Cross-Site Request Forgery — attack surface, exploitation techniques, SameSite and token bypasses, real-world chains, and detection/prevention. Mixing it up with SSRF? CSRF vs SSRF: Key Differences, Examples & Defenses puts the two side by side. Table of Contents Fundamentals Attack Surface & Preconditions Attack Delivery Techniques Content-Type & JSON CSRF SameSite Cookie Model SameSite Bypass Techniques CSRF Token Bypasses Referer / Origin Check Bypasses Method Override & Verb Tampering Login & Logout CSRF CORS Misconfiguration Chains Clickjacking Overlap Real-World Cases & CVEs Exploitation Chains Tools & Automation Detection & Testing Methodology Prevention & Defense in Depth Payload Quick Reference 1. Fundamentals Cross-Site Request Forgery (CSRF / XSRF / “sea-surf”) is an attack that tricks an authenticated user’s browser into submitting a state-changing request to a target application. The victim’s browser automatically attaches ambient credentials — cookies, HTTP Basic auth, client certificates, Kerberos tickets, IP-based authorization — so the target application cannot distinguish a forged request from a legitimate one. ...

The one-line difference: CSRF tricks a user’s browser into sending a request the user didn’t intend; SSRF tricks your server into sending a request the attacker chose. They both have “request forgery” in the name, so people lump them together. But they’re completely different beasts that’ll bite you in completely different ways, and the defense for one does nothing for the other. I’ve spent way too many nights debugging both, so here’s the side-by-side first, then the detail. ...