About

csrf.page is a reference for cross-site request forgery, written for how browsers actually behave in 2026 rather than how they behaved when most CSRF material was written.

Why it exists

Nearly every CSRF tutorial still online predates Chrome 80. It teaches the auto-submitting cross-site POST form as the CSRF attack — an attack that has not worked by default in Chromium since 2020, and still works fine in Firefox and Safari.

That leaves testers making two opposite mistakes:

Testing in Chrome, seeing nothing, and concluding an endpoint is protected when it is exploitable in two other engines.
Testing in Firefox, seeing it work, and reporting “CSRF” without qualification — then having it closed by a triager using Chrome.

Both come from the same gap: no widely-available reference states, per delivery shape and per cookie policy, which engines send the cookie. That table is the core of this site.

How the claims are kept honest

Browser behaviour here is not prose that someone remembered to update. It lives in a single data file, and three things are derived from it:

The cheatsheet matrix.
The per-engine verdict shown by the PoC generator.
The defence outcomes in the lab.

A build-time check runs every one of the generator's 900 delivery combinations, proves the encoding round-trips (including the text/plain JSON padding trick), and asserts that every machine-checkable cell of the cheatsheet agrees with what the generator produces. If the table and the generator ever disagree, the build fails. When browser policy changes, that is one file to edit rather than a thirty-two-guide audit.

Two rows of the cheatsheet — the WebSocket handshake and the same-site gadget — are prose rather than machine-checked, and the check script says so in its output rather than letting them pass silently.

Who it is for

Penetration testers and bug bounty hunters who need to know whether a finding is real and which browsers to name in the report; and engineers who need to know which control closes which gap. The methodology guide is written for the first group, the seven framework guides for the second.

Authorized testing only

Everything here is for education and for security testing you are authorized to perform. Testing systems without explicit written permission is illegal in most jurisdictions. Generated proofs of concept default to RFC 2606 reserved hostnames so that a copy-pasted payload cannot fire at a bystander.

Corrections

Browser policy moves, and the cookie behaviour on this site is exactly the kind of thing that goes stale. If something here is wrong, please open an issue. Corrections to the behavioural matrix are especially welcome — that file is the one everything else depends on.