Learn in the textbookAttacks on Web Applications
DefinitionCross-site request forgery (クロスサイトリクエストフォージェリ, CSRF) is an attack that lures a user who is still logged in to a legitimate site onto a trap page, making the user's browser send that site a request (asking the server to carry out some processing) the user never intended.
ExplanationA trap page contains a mechanism that, as soon as the page opens, sends the legitimate site a request to post something or change a setting. Because the request arrives from the logged-in user's browser, the site's server cannot distinguish it from the user's own action and carries it out. One countermeasure is for the site to check a secret value (a token) that shows whether the request came from its own genuine page.
AnalogyIt is like someone slipping a fake application form into the stack of papers a person's messenger is carrying. The messenger hands the whole stack in at the counter, and because it came from that person's own messenger, the counter accepts the fake as a genuine request.
Memory hook"Forgery" here refers to a forged request to the server.