What is a CSRF Attack? Explained for UK Website Owners

What is a CSRF attack? Explained for UK website owners

A Cross-Site Request Forgery attack — CSRF, sometimes pronounced "sea-surf" — is one of the most consistently exploited web application vulnerabilities. It works by tricking a user who is already logged into your website into unknowingly sending a request to it.

How CSRF works in practice

Imagine a user is logged into their online banking at bank.co.uk. In another browser tab, they visit a website controlled by an attacker. That website contains a hidden form or invisible image tag that sends a request to bank.co.uk — for example, a transfer of £500 to the attacker's account.

Because the user is already logged in, their browser automatically sends their authentication cookies with the request. The bank's server receives an authenticated request that looks completely legitimate. The transfer goes through. The user had no idea.

The attack works because browsers attach cookies to requests automatically, regardless of which website initiated the request.

What actions CSRF can trigger

CSRF can trigger any action a logged-in user can perform: changing an email address or password, making a purchase or payment, transferring funds, deleting data, changing account settings, or granting permissions to a third party.

Who is at risk

Any website that uses cookie-based authentication and processes state-changing actions — form submissions, button clicks, API calls — is potentially vulnerable to CSRF if it does not implement proper protections.

E-commerce sites, banking applications, account management portals, admin panels, and SaaS dashboards are all common targets.

How CSRF is prevented

The standard protection is a CSRF token — a unique, unpredictable value generated by the server and embedded in every form. When the form is submitted, the server checks that the token matches. An attacker cannot forge a valid token because they cannot read the victim's page content.

The SameSite cookie attribute is a modern browser-level protection that restricts when cookies are sent with cross-origin requests. Setting SameSite=Strict or SameSite=Lax on session cookies prevents the browser from sending them with cross-site requests entirely.

Does Yrzo AI test for CSRF?

Yes. Yrzo AI checks whether your forms and state-changing endpoints include CSRF protection. Starting at £399 for a full report.