What is cross-site request forgery (CSRF)?
Cross-site request forgery (CSRF) is an attack where a different website makes a logged-in user's browser send a request to your app without the user knowing. Because browsers attach login cookies automatically, your app thinks the request is genuine and carries it out, for example changing an email address or deleting an account.
Also called: CSRF, XSRF
ON THIS PAGE
What it means
Imagine you are logged in to your app in one tab and open a booby-trapped page in another. That page can quietly send a request to your app. Your browser helpfully includes your login cookie, so your app sees a valid, logged-in request.
It only works when your app relies on cookies for login and does not check where the request came from. Apps that send a token in a header on every request are mostly not affected.
Why it matters for vibe-coded apps
Many AI-built apps add a quick endpoint for an action, like deleting something, and protect it only by checking that the user is logged in.
- Users can be made to change their email or password without noticing.
- Money moves, accounts get deleted or settings change on a single click of a bad link.
- An admin who visits the wrong page can be used to attack the whole app.
Example
A delete-account action that only checks the user is logged in.
app.get("/account/delete", requireLogin, deleteAccount);res.cookie("session", id, { httpOnly: true, secure: true, sameSite: "lax" });
app.post("/account/delete", requireLogin, checkCsrfToken, deleteAccount);The cookie setting stops other sites from sending it, and the token proves the request came from your own page.
How to check if your app has this problem
- 1List every action that changes something: delete, update, pay, invite.
- 2Check that none of them can be triggered by a plain link (GET request).
- 3Look at your login cookie. It should be marked SameSite=Lax or Strict.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Use POST, PUT or DELETE for anything that changes data, never GET.
- 2Set the SameSite attribute on your login cookie to Lax or Strict.
- 3Add a CSRF token to forms if you use cookie logins, or use your framework's built-in protection.
- 4Run a check again to confirm.
Review my project for actions that change data and are protected only by a login cookie. Make sure none of them run on GET requests, set the login cookie to HttpOnly, Secure and SameSite=Lax, and add CSRF protection using the framework's built-in feature. Don't change anything else.
Check if your app has this problem
Paste your website and we'll check for cross-site request forgery (CSRF) issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- Cross-site scripting (XSS)Someone sneaks code into your pages that runs in other users' browsers.
- CORSA browser rule that decides which websites can call your API.
- Security headersSettings your site sends that tell browsers how to protect visitors.
- Authentication vs authorizationChecking who someone is, versus checking what they're allowed to do.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.