Cross-site request forgery (CSRF) explained

Cross-site request forgery tricks a logged-in user's browser into performing an action they never intended — on a site where they are already authenticated.

The attack works like this: a user is logged in to your site, then visits a malicious page elsewhere. That page quietly instructs the user's browser to send a request to your site — changing a password, making a purchase, altering settings — and because the browser is already logged in, your site may accept it as genuine.

CSRF matters because it abuses the trust between a site and a user's own browser, and the user need do nothing more than view a booby-trapped page. A penetration test checks whether your important actions are protected against being triggered this way, and the report sets out any gaps and the standard protections that close them.