Glossary · Phase 8 · APIs
Cross-site request forgery
An attack where another website makes your browser send a request to a site you're signed in to, with your cookies, without you knowing.
Try it now
Only the final GET is repeated by a reload, so nothing is saved twice.
Learn it properly
Forms and redirects · GET and POST, validation messages, post/redirect/get, flash messages and CSRF tokens. About 45 minutes.
Other terms from the same lesson
- flash message: A one-time note, like "Saved.", that a web app keeps for the next page to show once, usually after a redirect.
- post/redirect/get: Answering a successful form submission with a redirect instead of a page, so reloading repeats a harmless GET rather than sending the form again.
- query string: The part of a web address after the ?, holding named values, as in /search?q=fern&page=2.
Never trained an AI?
Teach a small one to write, right in your browser. It takes about 20 seconds and needs no account.