XSRF

Another name for CSRF, forcing an authenticated user to make unwanted requests.

XSRF, more commonly written CSRF, tricks a victim's authenticated browser into sending a forged request to a site where they are already logged in, causing actions such as changing settings or transferring funds without consent. It abuses the automatic inclusion of session cookies. Standard defenses include anti-CSRF tokens, the SameSite cookie attribute, and re-authentication for sensitive actions. A useful exam contrast is XSS, which executes attacker script in the victim's browser rather than forging a single request.