CSRF (Cross-Site Request Forgery) navodi autentificirani korisnikov preglednik da pravi neželjene zahtjeve na stranicu gdje je korisnik autentificiran — izvršavajući radnje (transfere, promjene) bez njihove suglasnosti, iskorištavajući automatsko slanje kredencijala/kolačića od strane preglednika.
Kako CSRF funkcionira
The attack exploits that browsers AUTO-SEND cookies (incl. session cookies) with requests:
1. a user is LOGGED IN to a site (has a session cookie)
2. the user visits a MALICIOUS page (or clicks a crafted link)
3. that page makes a request to the target site (e.g. a hidden form auto-submitting)
4. the browser AUTOMATICALLY includes the user's session cookie → the site thinks it's
a legitimate request from the user → performs the action (transfer money, change email)
→ the user unknowingly performs an action they didn't intend.
