Lion Cipher Lab

Exploit and fix CSRF (Cross-Site Request Forgery) in your own lab

• AppSec / DevSecOps
• Intermediate
• ~60 min
• Free · no account required

Why it matters

CSRF — Cross-Site Request Forgery — is the bug where a page you never trusted reaches across the web and makes YOUR browser act as you, on a site you are logged into. It does not steal your password or your session cookie; it simply gets your browser to send a request, and because browsers automatically attach a site's cookie to every request bound for that site, the target cannot tell the forged action from a real one. The classic victims are exactly the actions that matter: transfer money, change the account email, add an admin, delete a repo. For years this was one of the most common…

What you'll learn

• explaining what CSRF is: a page you did not trust tricks your logged-in browser into sending a state-changing request, and the browser attaches the target site's session cookie automatically so the site cannot tell the forgery from the real thing
• building a tiny cookie-authenticated 'bank' web app with a POST /transfer endpoint that has no CSRF protection at all
• writing a malicious auto-submitting HTML form on a second local origin that forces a transfer while you are logged in
• watching the forged transfer succeed and reading the balances to prove money moved with no click of yours
• adding a synchronizer CSRF token — a per-session secret embedded in the real form and verified server-side so forged requests fail
• setting the SameSite cookie attribute (Lax/Strict) and understanding exactly what it does and does not stop
• verifying the Origin/Referer header so the server refuses state-changing requests that did not come from its own pages
• judging when to reach for a token vs SameSite vs the double-submit-cookie pattern, and why pure token-auth (Authorization header) APIs are far less exposed to CSRF than cookie-auth apps

Steps in this lab

1. What CSRF is — and the ground rules
2. Set up: install Flask, then build the VULNERABLE bank
3. Log in, make an honest transfer, then fire the CSRF
4. Fix it: add the three standard defenses
5. Re-test: confirm the CSRF is dead and the feature still works
6. The judgment: token vs SameSite vs double-submit — and why SameSite alone is not enough
7. What you did — and the reflex to keep

Open the full interactive lab →