CSRF attacks work because…
Options
- Passwords are weak and easy for bots to guess
- Browsers attach cookies to cross-site requests (Correct option)
- HTTPS is missing on the target site entirely
- The API uses JSON bodies instead of form data
Answer
Browsers automatically attach cookies to cross-site requests, so a malicious page can trigger authenticated actions
Why
You are logged in to bank.com, so your browser has its session cookie. You visit evil.com, which secretly submits a form to bank.com/transfer. Your browser adds the bank cookie automatically, so the bank thinks YOU sent it.
That is CSRF (Cross-Site Request Forgery).
Defenses: SameSite=Lax or Strict cookies, anti-CSRF tokens in forms, checking the Origin header, and never changing data with GET.
Remember
CSRF = another site uses your logged-in cookies. Use SameSite + CSRF tokens.