What is CSRF?
An attack that makes a logged-in user’s browser perform an unwanted action because the app trusts the session cookie without a per-request token.
CSRF: An attack that makes a logged-in user’s browser perform an unwanted action because the app trusts the session cookie without a per-request token.
In plain language
In a CSRF attack, a victim who is logged in to your app visits a malicious page, which silently submits a request — change email, transfer funds — that the browser dutifully sends with the victim’s cookies. The app can’t tell it apart from a real click.
SuperPentest confirms CSRF where it matters: on state-changing endpoints, checking whether a token or SameSite protection is actually enforced, and reproducing a real cross-origin action as proof. See CSRF testing.
A concrete example
The endpoint POST /account/email changes your login email and is protected only by the session cookie. An attacker hosts a page that auto-submits that form; a logged-in victim who visits it has their email — and then, via reset, their whole account — taken over. SuperPentest confirms it by firing the request cross-origin and checking whether a token or SameSite rule actually stops it.
Related
CSRF testing → · Broken access control →
Want this tested on your app? Book a demo or read how findings are verified.