csrf/login

CSRF vulnerability on unauthenticated login forms

CSRF vulnerabilities can occur on login forms where user is not authenticated. While traditional CSRF requires authentication, login CSRF attacks can still exploit unprotected login endpoints. For example, attacker uses CSRF to assume authenticated identity on shopping site with attacker's account, then victim enters credit card details, enabling attacker to purchase items using victim's stored card. Mitigation: create pre-sessions (sessions before user authentication), include CSRF tokens in login forms, destroy pre-session and create new session upon authentication to avoid session fixation attacks, or use custom request headers in AJAX requests.