CSRF attacks are basically session hijacking. Say I'm logged in to foo.com
, which has an endpoint like POST http://foo.com/api/password { "password": $newPassword }
. Obviously this endpoint will fail if I'm not logged in, but that's not enough protection on its own, assuming the proof of my login is stored as a session cookie. An attacker could set up a site like attacker.com
, and on load of the attacker site, it automatically makes a request like POST http://foo.com/api/password { "password": "uHackedNow!" }
. If I visit http://attacker.com
while logged in to foo.com
, and foo.com
doesn't have CSRF protection built in, I'm screwed, because the browser will automatically send along my foo.com
cookies (including the session cookie) on requests to foo.com
, and thus the attacker is able to change my password.
The below is a quick summary of notes from: