Cross-Site Request Forgery (CSRF) prevention protects web applications from attacks where malicious websites trick authenticated users' browsers into submitting unwanted requests to trusted applications. CSRF exploits the browser's automatic inclusion of cookies and credentials with requests, allowing attackers to perform state-changing actions -- transferring funds, changing passwords, modifying settings -- without the user's knowledge or consent.
The primary CSRF defense is the synchronizer token pattern, where the server generates a unique, unpredictable token for each user session and embeds it in forms and AJAX request headers. The server validates that incoming state-changing requests include a valid token, rejecting requests without matching tokens. Since the token is embedded in the application's HTML rather than stored in cookies, cross-origin attackers cannot access it. The SameSite cookie attribute provides browser-level CSRF protection by controlling whether cookies are sent with cross-site requests -- setting SameSite to Strict prevents cookies from being included in any cross-origin request, while Lax permits cookies for top-level navigations but blocks them for cross-origin POST requests. Custom request headers provide additional protection for AJAX-heavy applications because browsers enforce same-origin policy on custom headers. Double-submit cookie patterns embed a random value in both a cookie and a request parameter, with the server verifying they match. Origin and Referer header validation checks that requests originate from the expected domain.
CSRF attacks are dangerous because they execute with the full privileges of the authenticated user. If an administrator visits a malicious page while logged into a management console, CSRF can create accounts, modify configurations, or exfiltrate data through the administrator's session. The attack requires no vulnerabilities in the target application itself -- only the absence of CSRF protections.
CDA addresses CSRF prevention within VSD as a standard web security control. Theater missions verify CSRF token implementation across all state-changing endpoints, configure SameSite cookie attributes, and test for bypass techniques that circumvent incomplete CSRF protections.