Software Engineering › Key terms › Y12 Secure Software Architecture › Cross-site request forgery (CSRF)
Cross-site request forgery (CSRF)
Term Key terms bank Y12 Secure Software Architecture
Also listed as: CSRF
Definition
An attack that tricks a logged-in user's browser into sending an unwanted request to a site that trusts them. Prevent it with anti-CSRF tokens.
Example: A hidden form submits a bank transfer.
Found in: syllabus, school notes.
Cross-site request forgery: forged request using a logged-in user's trust.
Where it is used in the test
Syllabus area: Y12 Secure Software Architecture.
Question types it can appear in
- Multiple choice: Pick the option that matches the definition or example.
- Short answer: Define, outline or explain it and tie it to the scenario.
- Fill in the blanks: Choose this term to complete a statement or table.
Where it has appeared in the paper
Secure Software Architecture (Part A). Part letters follow each paper’s own layout.
Related past questions
- 2025 HSC Q8 (1 mark): User action controls Secure Software Architecture (Part A) · 1 mark
These are the questions the flashcard set links to this term. Open each one and compare your answer with its marking criteria.
Study links
- Flashcard: Cross-site request forgery (CSRF) in Secure Software Architecture (Year 12) · study that set
- Memorise: User action controls: broken authentication, XSS, CSRF, forwarding, race conditions
- Key terms bank entry: CSRF
- Notes: User action controls: broken authentication, XSS, CSRF, forwarding, race conditions (Secure Software Architecture (Year 12))
- Notes: Design, develop and implement secure code to minimise vulnerabilities in user action… (Secure Software Architecture (Year 12))
How to use it in an answer
A model sentence
“An attack that tricks a logged-in user's browser into sending an unwanted request to a site that trusts them.” Then apply it: A hidden form submits a bank transfer.
In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.
Command words used with it
- Identify: Recognise and name. (2025 HSC Q8 (1 mark): User action controls)
Technique for the question types
- Multiple choice: Read all four options, rule out wrong ones, pick one; no penalty for guessing so never leave blank.
- Short answer: One clear point per mark, use the stimulus and course terms, and answer the command word.
- Fill in the blanks: Choose the right word from a list; use exact syllabus terms.
Common mistakes
- Use the term exactly as the syllabus words it, then link it to the scenario in the question; the 2025 feedback repeatedly rewards using the stimulus.
- Answer the command word: outline gives main points only, explain gives a reason or cause, discuss gives both sides.
Related terms
Same group in the syllabus: Broken authentication and session management · Cross-site scripting (XSS) · Invalid forwarding and redirecting · Race condition · File attacks · Side channel attack