Compliance Node Overview
CWE-352 (Cross-Site Request Forgery, commonly known as CSRF or XSRF) is a web application security weakness whereby an attacker tricks an authenticated user's browser into submitting state-changing requests the user did not intend. CWE-352 is defined as: the web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. CSRF exploits the trust a web application places in the user's browser by leveraging authenticated session cookies that the browser attaches automatically to outbound requests. Common Consequences expose multiple security dimensions including confidentiality, integrity, and availability: an attacker can trick a user into making unintended requests while authenticated, potentially allowing unauthorized data access and modification; privilege escalation if the victim holds administrative rights; complete application compromise including data theft or product manipulation; and effective operation under the victim's identity. Potential Mitigations include architecture and design controls: employing anti-CSRF libraries (OWASP CSRFGuard or security frameworks providing built-in protections); generating unique unpredictable nonces for each form submission; requesting confirmation for sensitive operations; implementing double-submitted cookie validation (pseudorandom values in both form and cookie); avoiding GET methods for state-changing requests. Implementation mitigations include eliminating cross-site scripting vulnerabilities (since XSS bypasses CSRF defenses) and validating HTTP Referer headers (though this may impact legitimacy and privacy). Modern CSRF mitigations also include SameSite cookie attribute (SameSite=Lax for default, SameSite=Strict for high-sensitivity operations) and origin-based defenses (validating Origin and Referer headers per the OWASP CSRF Prevention Cheat Sheet).
Pillar: Cybersecurity · Authority: MITRE Corporation / Common Weakness Enumeration · Version: 1.0.0 · Last updated:
Primary source: https://cwe.mitre.org/data/definitions/352.html
SHA-256 integrity: 4b0343a2dc8fae4a7d98397cb39bb409f5a33e3474c18ed55898a7a600f9450e
Primary Citations — 9 traced to source
- CWE-352: Cross-Site Request Forgery (CSRF) - MITRE Common Weakness Enumeration at https://cwe.mitre.org/data/definitions/352.html
- CWE-352 Definition - the web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor
+ 7 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
⚠ Important: Human Verification Required
Bidda compliance nodes are reference intelligence, not legal advice. Every node must be reviewed by a qualified compliance professional or legal counsel before implementation in any enterprise workflow, regulated system, or compliance programme. See bidda.com/disclaimer for full terms.