Introduction to Cross Site Request Forgery (CSRF) What is Cross
Site Request Forgery - CSRF When you take an action online -
submitting a blog post, delete a photo, registering on a site,
transferring money in a bank account - you are making a request
to a site to perform that action for you. Several things happen
automatically when you make a request to a site: lots of data is
sent using either a "POST" or "GET" method of the HTTP protocol
and your browser sends along any cookies you have for the site.
The cookies contain your session identification for the site
which is how the site knows who you are and what permissions you
have. A CSRF occurs when a malicious user can trick you into
making a specific kind of request to a site that you did not
really intend to make AND when the site performs that action
without confirming your intent. A simple example follows: - Your
site has a list of accounts and presents links to delete
accounts. That link points to a URL like
http://example.com/admin/delete/user/2 whic