CSRF (cross-site request forgery)
Another site making a logged-in user’s browser send a request to your app, which the app trusts because the cookie came along.
A form on an attacker’s page posts to your “change email” endpoint; the browser attaches the session cookie, and the change goes through. Defenses are SameSite cookies, anti-CSRF tokens in forms, and checking the Origin header on requests that change state. APIs that use a bearer token in a header instead of cookies are not exposed in the same way.
Related terms
- XSS (cross-site scripting): Attacker-controlled script running in your page in another user’s browser, with that user’s session.
- CORS (cross-origin resource sharing): Headers that tell the browser which other websites may read responses from your API.
- OAuth: A standard that lets an app act on a user’s account elsewhere (mail, calendar, files) without ever seeing the password.
