A cross-site request forgery (CSRF) attack occurs when a trusted user of a web application can be forced, by an attacker, to perform sensitive actions that he didn’t intend, such as updating his profile or sending a message, more generally anything that can change the state of the application.

The attacker can trick the user/victim to click on a link, corresponding to the privileged action, or to visit a malicious web site that embeds a hidden web request and as web browsers automatically include cookies, the actions can be authenticated and sensitive.

## Ask Yourself Whether

- The web application uses cookies to authenticate users.
- There exist sensitive operations in the web application that can be performed when the user is authenticated.
- The state / resources of the web application can be modified by doing HTTP POST or HTTP DELETE requests for example.

There is a risk if you answered yes to any of those questions.

## Recommended Secure Coding Practices

- Protection against CSRF attacks is strongly recommended:
  - to be activated by default for all unsafe HTTP methods.
  - implemented, for example, with an unguessable CSRF token
- Of course all sensitive operations should not be performed with safe HTTP methods like `GET` which are designed to be used only for information retrieval.

## Sensitive Code Example

    public void ConfigureServices(IServiceCollection services)
    {
        // ...
        services.AddControllersWithViews(options => options.Filters.Add(new IgnoreAntiforgeryTokenAttribute())); // Sensitive
        // ...
    }

    [HttpPost, IgnoreAntiforgeryToken] // Sensitive
    public IActionResult ChangeEmail(ChangeEmailModel model) => View("~/Views/...");

## Compliant Solution

    public void ConfigureServices(IServiceCollection services)
    {
        // ...
        services.AddControllersWithViews(options => options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute()));
        // or
        services.AddControllersWithViews(options => options.Filters.Add(new ValidateAntiForgeryTokenAttribute()));
        // ...
    }

    [HttpPost]
    [AutoValidateAntiforgeryToken]
    public IActionResult ChangeEmail(ChangeEmailModel model) => View("~/Views/...");

## See

- OWASP - Top 10 2021 Category A1 - Broken Access Control
- CWE - CWE-352 - Cross-Site Request Forgery (CSRF)
- OWASP - Top 10 2017 Category A6 - Security Misconfiguration
- OWASP - Cross-Site Request Forgery
- STIG Viewer - Application Security and Development: V-222603 - The application must protect from Cross-Site Request Forgery (CSRF) vulnerabilities.
- PortSwigger - Web storage: the lesser evil for session tokens