CSRF and when it applies
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
know when cross-site request forgery matters.
Planned topics
- CSRF: a malicious site makes the user's browser send a request to your site, and the browser attaches the user's cookies automatically.
- It matters when authentication is carried by cookies that the browser sends by itself.
- Defenses: CSRF tokens,
SameSitecookies, and checking the request origin. - If your API uses an
Authorizationheader token that scripts add explicitly, the browser does not add it on its own, so CSRF is not the same risk. - CORS and CSRF are different: CORS controls which pages may read responses; CSRF defends state-changing requests that use cookies.
Draft outline details
Demonstration
| CORS | CSRF | |
|---|---|---|
| Concern | Which origins may read responses | Forged actions using cookies |
| Applies | Browser calls across origins | Cookie-authenticated browsers |
Check your understanding
Why is a bearer-token API less exposed to CSRF?
Show answer
The browser does not attach the header automatically.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.