Actions triggered from elsewhere.
WHAT IT IS
Another site causing a visitor's browser to perform an action on yours, using their existing session.
WHAT IT ALLOWS
Changing settings Making purchases Transferring things
All as the legitimate user.
WHAT PREVENTS IT
A token, issued with each form and verified on submission.
WHY IT WORKS
Another site cannot read your token.
WHAT FRAMEWORKS PROVIDE
Protection enabled by default, with a helper to include the token.
WHAT TO CHECK
That it is enabled That it has not been disabled for convenience
THAT LAST POINT
Disabling it to make something work is a common and serious error.
WHAT ELSE TO DO
Use appropriate request methods: retrieval should never change state
WHY
A retrieval that changes something can be triggered by a simple link or image.
WHAT ELSE HELPS
Cookie settings restricting when cookies are sent across sites.
WHAT TO TEST
Submitting a form without the token, and confirming it is rejected.
