Two security researchers have released details on some very scary Cross-Site Request Forgery (CSRF) attacks that affect some of the largest sites on the web. The sites detailed in the report from ...

A CSRF attack is a serious Web security threat that, combined with XSS, can be lethal. Learn about the CSRF attack’s anatomy, along with mitigation methods.

Quarkus has released a new release that integrates RESTEasy APIs with an integrated control against CSRF attacks, making web applications more resilient against certain types of fraud.

Hackers are trying to exploit CVE-2024-52875, a critical CRLF injection vulnerability that leads to 1-click remote code execution (RCE) attacks in GFI KerioControl firewall product.

Unlike an XSS attack, which tricks the site into uploading malicious code, CSRF simply has the site execute legitimate commands–just not commands issued by the user.

CSRF attacks involve placing malicious code on a website to force visitors’ browsers to send specially crafted requests to a third-party URL.

French researcher Kafeine has found an exploit kit delivering cross-site request forgery attacks that focus on SOHO routers and changing DNS settings to redirect to malicious sites.

That said, CSRF vulnerability can be handled and mitigated in the popular web frameworks, thanks to the anti-CSRF techniques offered by top web frameworks — both frontend and backend. However, those ...