CSRF tricks a victim's browser into sending a request to a site the victim is already logged into — without the victim ever intending to make that request. The core mechanism is simple: browsers automatically attach session cookies to requests, regardless of where the request actually originated.
🎭 How CSRF Actually Works
The victim logs into a real, legitimate site — their browser now holds a valid session cookie proving they're authenticated.
⚠️CSRF doesn't need to steal anything or run code in the victim's browser — it just needs the victim to already be logged in somewhere, and to load a page the adversary controls. That's a dramatically lower bar than most attacks you've studied.
Concept
Two Attacks, Two Different Kinds of Trust
XSS and CSRF are easy to mix up because both involve a browser and a malicious action — but they exploit fundamentally different relationships.
⚖️ XSS vs. CSRF — click to compare
Trust in a user
The victim's own browser executes malicious code as if it came from the legitimate site — the site's users trust content served from that site, and XSS abuses that trust.
5.5.AConcept
Secure by Design and Secure by Default
Secure by design means security is treated as a design principle from the very start of development — not a feature bolted on afterward. It rests on three ideas:
Own the outcome
Companies take responsibility for their customers' actual security outcomes, not just technical compliance.
Radical transparency
Sharing security-related news and updates quickly, so the whole community benefits from what's learned.
Security-first leadership
Organizational structure and leadership genuinely oriented around security, not just checking a box.
Secure by default is the practical extension: software and devices should ship with security features already enabled — safe out of the box, not safe only after someone remembers to configure it.
5.5.BConcept
Input Sanitization: One Defense, Three Attacks Stopped
User input often gets wrapped in control characters — single quotes, double quotes, semicolons — so the application can process it correctly. Input sanitization checks that user input actually matches what's expected, and strips out or rejects anything that doesn't — including those control characters when they shouldn't be there.
ExampleGuided Example — One Fix, Three Attacks
An e-commerce site's product search field currently accepts any text and passes it directly into a database query and onto the results page.
Step 1 — Without sanitization: SQL injection
A search for ' OR 1=1 -- could manipulate the underlying database query, since the single quote and comment marker are passed through untouched.