srl
CSRF
Cross-Site Request Forgery (CSRF) tricks a victim’s browser into sending an authenticated request to a web application. The browser automatically attaches cookies, so the server cannot distinguish the forged request from a legitimate one. CSRF is not dead — SameSite cookies reduced the classic form-POST surface, but 2025–2026 produced a steady stream of bypasses through Content-Type parsing bugs, browser-level redirect flaws, and GraphQL/WebSocket endpoints that never had CSRF protection to begin with.