CSRF Attack Simulator
See live how a Cross-Site Request Forgery attack silently steals money — and how one line of protection stops it completely.
The bank blindly trusts every request. Any website can forge a transfer request on your behalf.
Login to Bank
Visit Attacker Site
See the Result
SecureBank Online
Your trusted digital bank
Step 1: Login to the bank first.
This sets a Session Cookie in your browser that the bank uses to identify you.
FREE PRIZES! Limited Time!
Totally not suspicious...
Step 2: Click the button below (as an unsuspecting user).
You think you're claiming a prize. But secretly, this button submits a form to the bank that transfers your money out.
Login to the bank first (on the left)
Live Server & Browser Logs
Logs will appear here as you interact with the simulator.
How CSRF Works (Explained Simply)
You login to bank.com
Browser saves your Session Cookie
You visit evil-site.xyz unknowingly
Evil site submits form to bank.com
Bank trusts the cookie & transfers money
3 Ways to Defend Against CSRF
Anti-CSRF Token (Best)
Server creates a secret random token for each session. Every form must include it. Attacker doesn't know this token, so forged requests fail.
SameSite Cookie
Set cookie attribute SameSite=Strict or Lax. Browser will NOT send the cookie for cross-site requests — attacker gets no cookie to abuse.
Origin Header Check
Server checks the Origin or Referer header to verify the request actually came from its own domain, not from evil-site.xyz.
About CSRF Playground
Interactively learn how Cross-Site Request Forgery (CSRF) attacks work and how Anti-CSRF tokens, SameSite cookies defend against them. This is a completely client-side simulation — no real requests are made.
Why use our CSRF Playground?
CSRF is one of the OWASP Top 10 web application security risks. Understanding it hands-on is the fastest way to learn how to protect your own applications. Toggle protection on and off to see the difference in real time.