Cross-site request forgery (CSRF)

Term Key terms bank

Jump to a topic

See every item in the sequence

Definition

An attack that tricks a logged-in user's browser into sending an unwanted request to a site that trusts them. Prevent it with anti-CSRF tokens.

Example: A hidden form submits a bank transfer.

Found in: syllabus, school notes.

Short version to memorise (key terms bank)

Cross-site request forgery: forged request using a logged-in user's trust.

Where you'll use it in the test

Syllabus area: Y12 Secure Software Architecture.

Question types it can appear in

Multiple choice: Pick the option that matches the definition or example.
Short answer: Define, outline or explain it and tie it to the scenario.
Fill in the blanks: Choose this term to complete a statement or table.

Where it has appeared in the paper

Secure Software Architecture (Part A). Part letters follow each paper’s own layout.

How to use it

A model sentence

General advice, built from the definition and example above

“An attack that tricks a logged-in user's browser into sending an unwanted request to a site that trusts them.” Then apply it: A hidden form submits a bank transfer.

In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.

Command words used with it

From the linked past questions

Identify: Recognise and name. (2025 HSC Q8 (1 mark): User action controls)

Go deeper

Flashcard: Cross-site request forgery (CSRF) in Secure Software Architecture (Year 12) · study that set
Memorise: User action controls: broken authentication, XSS, CSRF, forwarding, race conditions
Key terms bank entry: CSRF
Notes: User action controls: broken authentication, XSS, CSRF, forwarding, race conditions (Secure Software Architecture (Year 12))
Notes: Design, develop and implement secure code to minimise vulnerabilities in user action… (Secure Software Architecture (Year 12))
Full term page: every question, note and marking comment for Cross-site request forgery (CSRF)

Check yourself

Explain “Cross-site request forgery (CSRF)” in one sentence, give an example, and name a question type that could test it.

Reveal the answer

An attack that tricks a logged-in user's browser into sending an unwanted request to a site that trusts them. Prevent it with anti-CSRF tokens.

Example: A hidden form submits a bank transfer.

Could be tested as: Multiple choice, Short answer, Fill in the blanks.

Quick multiple choice

Which control is designed specifically to stop cross-site request forgery (CSRF)?

Compressing images on the page
A unique anti-CSRF token checked on each state-changing request
A longer domain name
Minifying the JavaScript files

Show the answer

CSRF tricks a logged-in user's browser into sending an unwanted request. A secret per-session token the attacker cannot know defeats it.

Source: original (written for this study pack; not a NESA question). Open it in the multiple-choice bank.