How Cross-Site Request Forgery (CSRF) Works & How to Prevent It

Is your application safe from Cross-Site Request Forgery? In this video, we break down exactly what a CSRF vulnerability is, use a simple real-world analogy to explain how it works, and cover the best ways to test and defend your application against these attacks. 🔒 Protect Your Code For Free: Don't let attackers take over your user accounts. Ensure your web applications are completely safe and free from CSRF vulnerabilities by running a quick scan with Aikido Security at https://aikido.dev today. Video Chapters 00:00 - Introduction to CSRF 00:42 - What is Cross-Site Request Forgery? 01:19 - The DMV Analogy 02:18 - Technical Explanation (Catbook) 03:47 - How the Attack Plays Out 05:41 - What is Blind CSRF? 06:49 - 3 Conditions Required for CSRF 08:00 - Same-Site Cookie Settings 08:30 - CSRF Tokens Explained 09:34 - Why CSRF Still Happens 10:44 - Real-World Breaches (YouTube, Google, GitHub) 12:01 - How to Scan and Test for CSRF 13:04 - Outro