SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-csrf-forged-request

Which attack forces a logged-in user's browser to perform an action they did not intend?

CSRF, a forged request sent with the victim's existing login.

Start playing free

  1. Cross-site request forgery (CSRF) ✔
  2. Cross-site scripting
  3. Session replay

Why: The victim is already authenticated, so the web app trusts the request. A link or page tricks their browser into sending an unwanted action.

Huh, didn't know that: OWASP says CSRF usually relies on a bit of social engineering, such as sending a link by email or chat.

The dad joke
CSRF is when your browser does a favor for a stranger without asking you first.
Like this card?
Play the game

References

Answer: Cross-site request forgery (CSRF). The victim is already authenticated, so the web app trusts the request. A link or page tricks their browser into sending an unwanted action.

  1. OWASP, Cross Site Request Forgery (CSRF) owasp.org/www-community/attacks/csrf
    an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhich web attack inserts a database query into an input field that the application then runs?Security & PrivacyWhich web attack injects malicious scripts into otherwise trusted websites so they run in other users' browsers?Security & PrivacyUsing sequences like ../ to reach files outside a web application's folder is called what?

That's stuff everyone should know.