CSRF (Cross Site Request Forgery) is also known as Sea-Surf or Session Riding. It's is a form of trick that bad folks play on the browser in order to get it to do unexpected things in applications that you're already logged in.
For example, imagine you were logged into your Supercell game on the internet. You get an e-mail saying "Click here to get 500 gems for free!". Clicking on the text, on the contrary, will actually initiate a request to Supercell to transfer all your gems to the hacker's account. Now, along with the request, the browser always sends the cookies to Supercell as well. Supercell verifies if the cookies are valid (which they are because you just logged in!), Supercell will trust the browser and the request and doesn't know that this is not what you wanted. They will go ahead and execute this instruction thinking this is what you wanted to do.
This is a CSRF. The browser & Supercell got tricked into doing something they shouldn't have done. There are multiple ways to prevent yourself and your website from a CSRF attack but that's a conversation for when you're 10. For now, stay away from spammy links. :D
For further actions, you may consider blocking this person and/or reporting abuse
We're a place where coders share, stay up-to-date and grow their careers.
Top comments (1)
CSRF (Cross Site Request Forgery) is also known as Sea-Surf or Session Riding. It's is a form of trick that bad folks play on the browser in order to get it to do unexpected things in applications that you're already logged in.
For example, imagine you were logged into your Supercell game on the internet. You get an e-mail saying "Click here to get 500 gems for free!". Clicking on the text, on the contrary, will actually initiate a request to Supercell to transfer all your gems to the hacker's account. Now, along with the request, the browser always sends the cookies to Supercell as well. Supercell verifies if the cookies are valid (which they are because you just logged in!), Supercell will trust the browser and the request and doesn't know that this is not what you wanted. They will go ahead and execute this instruction thinking this is what you wanted to do.
This is a CSRF. The browser & Supercell got tricked into doing something they shouldn't have done. There are multiple ways to prevent yourself and your website from a CSRF attack but that's a conversation for when you're 10. For now, stay away from spammy links. :D