Cross-site request forgery (CSRF), also known as session riding, is a web application attack that tricks an authenticated user into performing unintended actions on a trusted website. Because the request originates from the user’s active session, the application may process it as legitimate—even though the user never intended to perform the action.

CSRF attacks can be used to change account settings, initiate transactions, modify user data, or perform administrative actions without the victim’s knowledge. The impact depends on the permissions of the compromised account and the sensitivity of the targeted application.

{{anchor:How CSRF works}}

How CSRF works

CSRF attacks exploit the trust a web application places in an authenticated user's browser. An attacker creates a malicious request and then tricks a user into clicking a link, opening a webpage, or interacting with content while logged in to a vulnerable application.

If the application relies solely on session cookies for authentication and lacks proper validation mechanisms, the forged request may be accepted and processed as if it came directly from the user.

{{anchor:Why CSRF matters}}

Why CSRF matters

A successful CSRF attack can lead to:

• Unauthorized account changes
• Fraudulent transactions
• Data manipulation
• Account takeover scenarios
• Abuse of privileged or administrative access
• Loss of customer trust and reputational damage

Organizations that handle sensitive user data, financial transactions, or administrative functions are particularly vulnerable to the consequences of CSRF attacks.

{{anchor:Prevention}}

Preventing CSRF

Organizations can reduce CSRF risk by implementing security controls such as:

• Anti-CSRF tokens
• Cookie protections
• Secure session management
• User re-authentication for sensitive actions
• Built-in framework security features
• Regular application security testing

A layered approach to application security helps ensure that requests are both authenticated and intentionally initiated by the user.

{{anchor:How DigiCert helps}}

How DigiCert can help

Preventing CSRF requires secure application development practices, but protecting the infrastructure that supports your applications is equally important.

DigiCert UltraDNS provides secure, resilient, enterprise-grade DNS services that help organizations maintain the availability and integrity of critical online applications. With globally distributed infrastructure, DNSSEC support, intelligent traffic management, and built-in resilience against DNS-based attacks, UltraDNS helps provide a trusted foundation for digital services.

By strengthening DNS security and availability, DigiCert UltraDNS helps organizations support a broader defense-in-depth strategy that protects business-critical applications, reduces operational risk, and delivers reliable digital experiences for users.