Jeff Atwood had a good post on protecting your site / blog from being hacked.
It turns out I didn’t understand how cross-site request forgery, also known as XSRF or CSRF, works. It’s not complicated, necessarily, but it’s more.. subtle.. than XSS.
Let’s say we allow users to post images on our forum. What if one of our users posted this image?
Not really an image, true, but it will force the target URL to be retrieved by any random user who happens to browse that page — using their browser credentials! From the webserver’s perspective, there is no difference whatsoever between a real user initiated browser request and the above image URL retrieval.
You can read the full post here – http://tinyurl.com/4ne4xs
Tim Schoffelman of SilentGap
