Skip to content
Hallway
0:00 / 0:00

#csrf#cross-siterequestforgery#antiforgerytoken

CSRF Explained

Jmaxxz

159 subscribers • 1 video on Hallway

YouTube
  • Recommended by 1 person: 1 on Stack Overflow and its sister sites.
  • May be out of date. Uploaded 14 years ago, in an area where tools change fast.

Beginner. No background in the topic needed.

67K views14 years ago1 recommendation

SecurityWeb developmentWeb and application securityHTTP, REST and GraphQL

An explanation and demonstration of Cross-Site Request Forgery attacks and how they exploit browser trust.

Demo of site vulnerable to CSRF at csrf.suckysoftware.com/ Cross Site Request Forgery is an attack which exploits a web-server's trust in a user's browser. It is one of the most common attacks out there and one every developer should be aware of.

Why it's here

1 person recommends this

What people say. Recommended as a clear and helpful tutorial explaining how CSRF works.

Trevoron Stack Overflow • Recommends

On “How does AntiForgeryToken work”

Here's a good tutorial on CSRF: link to this video Here is the general gist: You are logged in to your bank's website. Your bank puts a cookie on your machine so it can authenticate you. Every time you make a request to (ie. load a page from) yourbank.com, the browser sends the cookie to the web server and the code on the web server checks the cookie to make sure you're authenticated. Great. However, while the cookie hasn't yet expired, you check your mail and open an email from a Nigerian Prince telling you to click on a link. You click on it (who can resist) and instead of taking you to the page the Prince has described, the link takes you to this URL: http://yourbank.com/transfer.aspx?amt=10…
88View the answer