CSRF Playground
A "bank" transfer endpoint trusts your cookie alone. Watch a malicious page forge a request on your behalf, then see a CSRF token stop it cold.
Cross-Site Request Forgery abuses the fact that browsers attach your cookies to requests automatically, whoever caused them. A malicious page makes your browser perform a real, authenticated action — then you switch on a CSRF token and watch the same attack fail.
How to use it
- Perform a normal transfer while logged in.
- Trigger the same request from an attacker page.
- Enable the CSRF token and watch it get rejected.
What to take away
The browser is the confused deputy
It holds your session and attaches it to any request to that origin. The server cannot tell intent from the cookie alone.
Tokens work because the attacker cannot read them
The same-origin policy stops a malicious page reading a token from your session, so it cannot include one.
SameSite cookies changed the landscape
SameSite=Lax by default in modern browsers blocks most cross-site request patterns — which reduced CSRF sharply without eliminating it.
Frequently asked questions
Is CSRF still relevant with SameSite cookies?
Less than it was, but yes. Legacy configurations, SameSite=None for third-party flows, and GET-based state changes all keep it alive.
What is the difference between CSRF and XSS?
CSRF makes your browser send a request you did not intend, without reading the response. XSS runs the attacker's code inside your origin, which is strictly worse — and defeats CSRF tokens outright.
Where this fits in the course
This security lab pairs with Path 11 — Web Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Clickjacking Simulator — An invisible iframe sits on top of a fake game button. See exactly how a real click lands on a hidden "delete account" button instead.
- Vulnerable Web App — A tiny deliberately-broken app for practicing XSS and login-bypass. Runs entirely in-browser; no server to attack, nothing to install.
- Security Header Analyzer — Paste HTTP response headers and get a graded report on the security headers present and missing.
- Open Redirect Playground — A login page trusts a returnUrl parameter completely. Turn a genuinely trusted link into a post-login phishing weapon.