cross-site request forgery
Cross-site request forgery induces an authenticated browser to send an unwanted request.
Use this when A browser automatically sends cookies to state-changing endpoints.
without the term
“We use cookie login. Could another website trick a logged-in user's browser into deleting their account on our site? Can you protect the forms and endpoints that change things?”
with the term · How do you ask a model for cross-site request forgery?
Protect these cookie-authenticated actions against CSRF. Test cross-origin requests and legitimate submissions without disabling the framework’s checks.
What is cross-site request forgery?
Another site makes the user's browser send a request to your app, and the browser attaches the user's cookies. The defense depends on how credentials are sent: SameSite cookies, tokens, or origin checks.
Why does cross-site request forgery matter when vibe coding?
A login check alone cannot prove that the user intended this request.
How do you do cross-site request forgery?
Use the framework’s CSRF protection and trusted-origin policy; verify state-changing requests from another origin.
What goes wrong with cross-site request forgery?
Assuming CORS prevents every cross-origin request from being sent.