Editing JavaScript (section)

=== Cross-site request forgery ===
{{Main|Cross-site request forgery}}

Another cross-site vulnerability is [[cross-site request forgery]] (CSRF). In CSRF, code on an attacker's site tricks the victim's browser into taking actions the user did not intend at a target site (like transferring money at a bank). When target sites rely solely on cookies for request authentication, requests originating from code on the attacker's site can carry the same valid login credentials of the initiating user. In general, the solution to CSRF is to require an authentication value in a hidden form field, and not only in the cookies, to authenticate any request that might have lasting effects. Checking the HTTP Referrer header can also help.

"JavaScript hijacking" is a type of CSRF attack in which a <code><nowiki><script></nowiki></code> tag on an attacker's site exploits a page on the victim's site that returns private information such as [[JSON]] or JavaScript. Possible solutions include:

* requiring an authentication token in the [[POST (HTTP)|POST]] and [[GET (HTTP)|GET]] parameters for any response that returns private information.