CSRF (Cross-Site Request Forgery) - imirt a dhéanann sé ar bhraistint úsáideora atá logáilte isteach chun iarratas neamhdhírithe a dhéanamh ar shuíomh ina bhfuil siad fíordheimhnithe — gníomhartha a dhéanamh (aistriúcháin, athruithe) gan a dtolladh, ag soláthraí ar an bhféinchuid atá ag an mbrabhsálaí le creidiúintí/briosca a shéineadh go huathoibríoch.
Conas a oibríonn CSRF
The attack exploits that browsers AUTO-SEND cookies (incl. session cookies) with requests:
1. a user is LOGGED IN to a site (has a session cookie)
2. the user visits a MALICIOUS page (or clicks a crafted link)
3. that page makes a request to the target site (e.g. a hidden form auto-submitting)
4. the browser AUTOMATICALLY includes the user's session cookie → the site thinks it's
a legitimate request from the user → performs the action (transfer money, change email)
→ the user unknowingly performs an action they didn't intend.
