课程: Programming Foundations: Web Security

今天就学习课程吧！

今天就开通帐号，24,600 门业界名师课程任您挑！

Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF)

课程: Programming Foundations: Web Security

开始一个月试用 购买团队方案

Cross-Site Request Forgery (CSRF)

“

- A cross-site request forgery attack is when an attacker tricks a user's browser into sending a request to another site. Cross-site because the attack originates on one site but sends a request to another site and request forgery because the request is not a genuine user request. Cross-site request forgery is often shortened to CSRF. Imagine that a hacker wants to get a user to click a link. One way would be to name the link with something deceptive and post it online or send it in an email. The link hides the action but it requires a user to actually click on it. A CSRF does not depend on the user clicking a link. Instead, the attacker places the URL into the HTML of a page, most often is the source attribute of an image tag. When the page loads, the browser automatically sends a request for each of the images that are in the HTML. It doesn't matter that this image source will fail to return an image. The request will…

内容