# Cross-Site Request Forgery (CSRF)

An attack that tricks a logged-in user's browser into performing unwanted actions on a site without their consent.

**Cross-site request forgery (CSRF)** is an attack that tricks a victim's browser into submitting an unwanted request, like changing an email address or transferring funds, to a site where they're already logged in, without their knowledge or consent.

Because the browser automatically includes the victim's session cookies, the malicious request appears legitimate to the server. Sites defend against CSRF using unique tokens tied to each user session that attackers can't predict or forge.