CSRF
CSRF (short for Cross Site Request Forgery) is an attack against a web user that forces the user's browser to perform unintended actions in web applications on the user's behalf by exploiting limitations in the HTTP protocol.
On this page
Source content checked . English translation published 2026-10-27.
In business automation
CSRF is relevant when a state-changing action on a server relies only on a session cookie. A malicious site can cause the browser of a logged-in user to send a request on their behalf, for example to approve an order or change a destination.
Examples
These examples illustrate a possible workflow. Adapt the connections and rules to your own systems.
Approving an order from an external link
A manager clicks a link in an email. The browser sends an approval request to the internal site because the cookie is still valid. Without a CSRF token or an origin check, the order is approved without the manager intending to do so on the screen.
Relevant tools
- n8n
- An incoming webhook needs a signature or secret and should not rely on the caller appearing to be the user logged in through a browser.
What to check
- A server-to-server webhook is not CSRF, but a browser form without a token may be vulnerable.