Cross-site request forgery

CSRF makes a logged-in user’s browser send a request they never intended. SameSite cookies and anti-forgery tokens close it.

What this lesson covers

• Understand how an ambient credential is abused
• Set SameSite cookie attributes correctly
• Validate anti-forgery tokens on state-changing requests

This lesson sits in Common Web Vulnerabilities, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.