Cross-site request forgery and ambient browser credentials

Mechanism

CSRF causes a browser to submit an unwanted state-changing request while attaching credentials the destination normally trusts. The browser may permit the request even when the initiating page cannot read the response. Cookie SameSite behavior, request method, content type, anti-CSRF tokens, and origin validation determine which cross-site requests are possible.

Practical method

Identify a state-changing action and its authentication mechanism. Check whether a unique token is bound to the user session and validated on every method. Build a harmless local cross-site form and observe actual cookie behavior. Compare Origin and Referer validation, including absent headers and same-site subdomains.

<form action="https://lab.example/preferences" method="POST">
  <input name="color" value="blue">
</form>

Interpreting evidence

Confirm the server state changed under the victim session; a submitted form alone does not establish successful authorization. Record the browser, cookie attributes, and initiating origin.

Pitfalls and limits

Same-site and same-origin are different concepts. Tokens accepted from another session are weak. JSON content types often require preflight, while simple form requests can be sent without it.