Security

What is Cross-Site Request Forgery (CSRF) (CWE-352)?

Learn how to prevent and detect Cross-Site Request Forgery (CSRF), a type of attack that tricks users into performing unintended actions on a web application.

Shreya Pillai July 28, 2026 5 min read Security

AI-friendly summary

What it is: Cross-Site Request Forgery (CSRF) is a type of attack that tricks users into performing unintended actions on a web application by exploiting the trust between the user's browser and the web server.

Why it matters: A successful CSRF attack can lead to unauthorized changes, data breaches, or even complete control over the affected application. It is essential to implement proper security measures to prevent such attacks.

How to fix it: Preventing CSRF requires implementing proper input validation and verification of requests, using secure tokens, and ensuring that sensitive operations are performed only on trusted requests.

TL;DR: Cross-Site Request Forgery (CSRF) is a type of attack that tricks users into performing unintended actions on a web application by exploiting the trust between the user’s browser and the web server.

At-a-Glance

Field	Value
CWE ID	CWE-352
OWASP Category	A01:2025 - Broken Access Control
CAPEC	CAPEC-111, CAPEC-462, CAPEC-467, CAPEC-62
Typical Severity	Medium
Affected Technologies	Web applications
Detection Difficulty	Moderate
Last Updated	2026-07-28

What is Cross-Site Request Forgery (CSRF)?

Cross-Site Request Forgery (CSRF) is a type of attack that tricks users into performing unintended actions on a web application by exploiting the trust between the user’s browser and the web server.

As defined by the MITRE Corporation under CWE-352, and classified by the OWASP Foundation under A01:2025 - Broken Access Control, Cross-Site Request Forgery (CSRF) is a type of attack that tricks users into performing unintended actions on a web application by exploiting the trust between the user’s browser and the web server.

Quick Summary

Cross-Site Request Forgery (CSRF) is a significant security threat to web applications. It can lead to unauthorized changes, data breaches, or even complete control over the affected application. Implementing proper security measures, such as input validation and verification of requests, using secure tokens, and ensuring that sensitive operations are performed only on trusted requests, can help prevent CSRF attacks.

Cross-Site Request Forgery (CSRF) Overview

What: Cross-Site Request Forgery (CSRF) is a type of attack that tricks users into performing unintended actions on a web application by exploiting the trust between the user’s browser and the web server.

Where it occurs: Cross-Site Request Forgery (CSRF) can occur on any web application that uses HTTP requests and relies on user input validation and verification.

Who is affected: Any user who interacts with a vulnerable web application can be affected by a CSRF attack.

Who is NOT affected: Users who do not interact with the vulnerable web application are not affected by a CSRF attack.

How Cross-Site Request Forgery (CSRF) Works

Root Cause

Cross-Site Request Forgery (CSRF) occurs when an attacker tricks a user into performing unintended actions on a web application by exploiting the trust between the user’s browser and the web server.

Attack Flow

The attacker crafts a malicious HTTP request that tricks the user into performing an unintended action.
The user, unaware of the attack, sends the malicious request to the vulnerable web application.
The web application processes the malicious request, leading to unauthorized changes or data breaches.

Prerequisites to Exploit

The attacker must have knowledge of the vulnerable web application’s functionality and security measures.
The attacker must be able to craft a malicious HTTP request that tricks the user into performing an unintended action.
The user must interact with the vulnerable web application, unaware of the attack.

Vulnerable Code

from flask import Flask, request

app = Flask(__name__)

@app.route('/submit', methods=['POST'])
def submit():
    if request.method == 'POST':
        # Process the request without verifying its origin
        data = request.form['data']
        # Perform sensitive operation based on user input
        perform_operation(data)

The vulnerable code above does not verify the origin of the HTTP request, making it susceptible to CSRF attacks.

Secure Code

from flask import Flask, request

app = Flask(__name__)

@app.route('/submit', methods=['POST'])
def submit():
    if request.method == 'POST':
        # Verify the origin of the HTTP request using a secure token
        token = request.headers.get('X-CSRF-Token')
        if token != get_secure_token():
            return 'Invalid token'
        data = request.form['data']
        # Perform sensitive operation based on user input, but only if the token is valid
        perform_operation(data)

The secure code above verifies the origin of the HTTP request using a secure token, preventing CSRF attacks.

Business Impact of Cross-Site Request Forgery (CSRF)

Confidentiality: A successful CSRF attack can lead to unauthorized access to sensitive data, compromising confidentiality.

Integrity: A successful CSRF attack can lead to unauthorized changes or modifications to sensitive data, compromising integrity.

Availability: A successful CSRF attack can lead to denial-of-service (DoS) attacks, compromising availability.

Real-world business consequences of a successful CSRF attack include:

Unauthorized access to sensitive customer data
Unintended changes or modifications to financial transactions
Denial-of-service (DoS) attacks on critical infrastructure

Cross-Site Request Forgery (CSRF) Attack Scenario

An attacker crafts a malicious HTTP request that tricks the user into performing an unintended action.
The user, unaware of the attack, sends the malicious request to the vulnerable web application.
The web application processes the malicious request, leading to unauthorized changes or data breaches.

How to Detect Cross-Site Request Forgery (CSRF)

Manual Testing

Use a web browser to interact with the vulnerable web application
Identify potential vulnerabilities by analyzing HTTP requests and responses
Verify that sensitive operations are performed only on trusted requests

Automated Scanners (SAST / DAST)

Use automated scanning tools, such as PenScan, to detect potential vulnerabilities
Analyze HTTP requests and responses for potential CSRF attacks
Verify that sensitive operations are performed only on trusted requests

PenScan Detection

PenScan’s scanner engines can detect potential CSRF vulnerabilities by analyzing HTTP requests and responses.

False Positive Guidance

When using automated scanning tools, be aware of false positives caused by legitimate functionality. Verify the context and intent behind each request to avoid misinterpretation.

How to Fix Cross-Site Request Forgery (CSRF)

Implement proper input validation and verification of requests
Use secure tokens to verify the origin of HTTP requests
Ensure that sensitive operations are performed only on trusted requests

Framework-Specific Fixes for Cross-Site Request Forgery (CSRF)

Java

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class CSRFFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        
        // Verify the origin of the HTTP request using a secure token
        String token = httpRequest.getHeader("X-CSRF-Token");
        if (!token.equals(getSecureToken())) {
            httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            return;
        }
        
        chain.doFilter(request, response);
    }
}

Node.js

const express = require('express');
const csrf = require('csurf');

const app = express();

app.use(csrf());

// Verify the origin of the HTTP request using a secure token
app.use((req, res, next) => {
    const token = req.header('X-CSRF-Token');
    if (!token || !token.equals(getSecureToken())) {
        return res.status(401).send({ error: 'Invalid token' });
    }
    
    next();
});

Python/Django

from django.http import HttpResponse
from django.views.decorators.csrf import csrf_exempt

@csrf_exempt
def submit(request):
    # Verify the origin of the HTTP request using a secure token
    token = request.META.get('HTTP_X_CSRF_TOKEN')
    if not token or not token == get_secure_token():
        return HttpResponse(status=401)
    
    # Perform sensitive operation based on user input, but only if the token is valid
    perform_operation(request.POST['data'])

How to Ask AI to Check Your Code for Cross-Site Request Forgery (CSRF)

Review the following code block for potential CWE-352 Cross-Site Request Forgery (CSRF) vulnerabilities and rewrite it using secure tokens:

from flask import Flask, request

app = Flask(__name__)

@app.route('/submit', methods=['POST'])
def submit():
    if request.method == 'POST':
        # Process the request without verifying its origin
        data = request.form['data']
        # Perform sensitive operation based on user input
        perform_operation(data)

Cross-Site Request Forgery (CSRF) Best Practices Checklist

✅ Implement proper input validation and verification of requests.

✅ Use secure tokens to verify the origin of HTTP requests.

✅ Ensure that sensitive operations are performed only on trusted requests.

Cross-Site Request Forgery (CSRF) FAQ

How does Cross-Site Request Forgery (CSRF) work?

What are the consequences of a successful Cross-Site Request Forgery (CSRF) attack?

A successful Cross-Site Request Forgery (CSRF) attack can lead to unauthorized changes, data breaches, or even complete control over the affected application.

How do I prevent Cross-Site Request Forgery (CSRF)?

Preventing Cross-Site Request Forgery (CSRF) requires implementing proper input validation and verification of requests, using secure tokens, and ensuring that sensitive operations are performed only on trusted requests.

Can AI help detect Cross-Site Request Forgery (CSRF) vulnerabilities?

Yes, AI-powered tools can analyze code and identify potential vulnerabilities, including Cross-Site Request Forgery (CSRF).

What is the best way to remediate a detected Cross-Site Request Forgery (CSRF) vulnerability?

Remediation of a detected Cross-Site Request Forgery (CSRF) vulnerability typically involves implementing proper input validation and verification, using secure tokens, and ensuring that sensitive operations are performed only on trusted requests.

Can I use a web application firewall (WAF) to protect against Cross-Site Request Forgery (CSRF)?

While a WAF can provide some protection against Cross-Site Request Forgery (CSRF), it is not a foolproof solution and should be used in conjunction with other security measures.

How do I know if my application is vulnerable to Cross-Site Request Forgery (CSRF)?

You can use automated scanning tools, such as PenScan, to detect potential vulnerabilities and identify areas for improvement.

CWE ID	Name	Relationship
CWE-345	Insufficient Verification of Data Authenticity	ChildOf
CWE-346	Origin Validation Error	Requires

References

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Cross-Site Request Forgery (CSRF) and other risks before an attacker does.