# CSRF
Allows an attacker to perform unauthorized actions on behalf of a victim user like changing the victim's password, making unauthorized purchases, or posting unwanted content via a POST request.
To exploit CSRF the target user has to be logged in to the target web application while visiting a malicious site in the same browser.
* if a user visits an attacker-controlled site, we can use JavaScript to send a POST request using the victim's cookies.
#### CSRF workflow
#### Example
Suppose an application allows users to change their email by submitting a form if the application is not protected against CSRF:
1. the attacker forces users to change their email to an attacker-controlled email
2. the attacker performs a password reset to change the users' password and take over their account
3. if there is no CSRF token, no authentication header, and the application fails to check the refer header, perform a CSRF attack
Request vulnerable to CSRF
4. create a proof of concept (POC) to prove that CSRF is possible:
