Skip to content
FrontendHaltFrontendHalt
Security·Intermediate·Conceptual·1 min read

What is CSRF?

Short interview answer

CSRF causes a browser to send an authenticated state-changing request that the user did not intend, usually because cookies are attached automatically. Defenses include SameSite cookies, unpredictable CSRF tokens, and Origin or Referer validation; state-changing GET requests remain a design flaw.

Key takeaway

Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.

← Back to Frontend security basics

Related questions