78 600 000 000
gemiusAdReal, badanie cross-mediowe rynku reklamowego w Polsce, sierpień 2026
Gemius09/2026Poland
An attack that tricks a logged-in user's browser into sending an unintended request to an application. Protection includes CSRF tokens, same-site cookies, and origin verification.
Why it matters
Protects against attacks where a malicious site performs actions using the credentials of a logged-in user — without knowing their password. CSRF tokens ensure the request originates from your form.
What's missing without it
Without protection, a logged-in administrator merely visiting a malicious site could have their settings changed or data deleted in the background.
When it is used
With every form and request that modifies data in an application where users are logged in.
How we use it
A user deletion form requires a CSRF token to prevent a third-party site from forcing the action.
Numbers worth knowing