View source for Cross-site request forgery

'''Cross-site request forgery''', also known as '''one-click attack''' or '''session riding''' and abbreviated as '''CSRF''' (sometimes pronounced sea-surf) or '''XSRF''', is a type of malicious exploit of a [[website]] where unauthorized commands are transmitted from a user that the website trusts.

== Comparison with cross-site scripting ==

Unlike [[cross-site scripting]] (XSS), which exploits the trust a user has for a particular site, CSRF exploits the trust that a site has in a user's browser.

== See also ==

* [[BREACH (security exploit)]]
* [[Confused deputy problem]]
* [[CRIME (security exploit)]]
* [[Cross-document messaging]]
* [[Cross-site scripting]]
* [[Heap spraying]]
* [[Replay attack]]
* [[Session fixation]]
* [[Web application security]]

== External links ==

* [https://en.wikipedia.org/wiki/Cross-site_request_forgery Cross-site request forgery] @ Wikipedia


[[Category:Web security]]