Overview
Cross-Site Request Forgery (CSRF) exploits a specific behavior of browsers: they automatically attach a site's cookies to requests to that site, regardless of where the request originated. Understanding this ambient authority is the key to understanding CSRF. This lesson covers the browser-trust behavior CSRF abuses.
Learning objectives
- Explain how browsers automatically send cookies.
- Define the ambient-authority problem.
- Set up why CSRF is possible.
Core concept
Browsers automatically include a site's cookies (including session cookies) on every request to that site — even when the request is triggered by a different site. This is called ambient authority: the user's authenticated state is applied to requests without the application distinguishing whether the user intended the action. CSRF abuses this: if an attacker's page can cause the victim's browser to send a request to a site where the victim is logged in, that request carries the victim's session automatically.
How it works
When you are logged into a site, your browser holds its session cookie and attaches it to any request to that site. If you visit an attacker's page that triggers a request to that site (e.g. via a form submission or embedded resource), the browser still sends your cookie — so the site sees an authenticated request that you did not intend. The site cannot tell, from the cookie alone, whether the request came from its own pages or was forged by another site. This gap between "authenticated" and "intended" is what CSRF exploits.
Practical example
You are logged into your bank in one tab. In another tab you open a malicious page. That page contains a hidden form that auto-submits a request to the bank (say, a funds transfer). Because your browser automatically attaches your bank session cookie to that request, the bank receives what looks like a legitimate authenticated action — even though you never intended it. The forged request "rides" your existing session. (Defenses that make the site verify intent are covered in later lessons.)
Cybersecurity relevance
Ambient cookie authority is the foundation of CSRF, a well-known web vulnerability that can cause state-changing actions (transfers, password/email changes, settings modifications) to be performed on behalf of an authenticated victim. The core insight — that authentication does not imply intent — motivates CSRF defenses (tokens, SameSite) covered next. Recognizing which requests are protected by anti-CSRF measures, and which rely purely on the auto-sent cookie, is central to assessing this class of flaw.
Common mistakes
- Assuming an authenticated request is an intended request — the browser sends cookies regardless of origin.
- Relying on the session cookie alone to authorize state-changing actions.
- Overlooking that any site can trigger requests to yours, carrying the victim's cookies.
Key takeaways
- Browsers automatically attach a site's cookies to every request to that site, even requests triggered by other sites (ambient authority).
- This means an authenticated request is not necessarily an intended one — the gap CSRF exploits.
- Because the cookie alone cannot prove intent, state-changing actions need explicit anti-CSRF verification (tokens, SameSite) covered in later lessons.
Check your understanding
- Why does a browser attach your session cookie to a request even when another site triggered it?
- What is the difference between a request being "authenticated" and being "intended," and why does it matter for CSRF?