title: CSRF Basics with SSL & CSRF Relationship
body: <p>I am trying to implement CSRF and SSL(they are not entirely dependent) and listing below my understanding on the topic for having a proof of understanding.
  Please feel free to correct me about the understanding. <br/>
  We see CSRF Token in almost all of our secure applications.</p>
  
  <p><strong>How Cross-Site Request Forgery (CSRF) works :</strong></p>
  
  <p>You logged into your bank account(eg. SBI or JPMC) and are looking at your accounts or it's just sitting their opened on your browser just because you got busy.
  Now you receive an email may be text/image or anything on the next tab. The moment the email is received functions like onload etc other java script function may trigger a GET/PUT/POST request from your browser without you knowing about it.
  Now things to note is that CSRF can't actually read anything from your secured webpage because the moment you have a proper SSL the secure pages are encrypted. And also CSRF can't steal your credentials. As a matter of fact it can't find out the CSRF token kept inside hidden tag inside secure website because its encrypted. It works only after you have authenticated yourself with the website and it fires requests which tricks the server into thinking that the request in coming from the browser you just logged into and thus server work as per the received request.</p>
  
  <p>Now with hacker trying to open a CSRF attack, it tricks the browser to send url:</p>
  
  <pre><code>&lt;img src="https://www.bankWebsite.com/transfer?amount=1000&amp;amp;destination=8990"&gt;
  </code></pre>
  
  <p>Thus without you knowing, from a session which is authenticated by you, a request is fired telling to transfer amount of 1000 in account number 8990 n BOOM you were robbed for 1000 bucks just like that.</p>
  
  <p><strong>How to protect youself:</strong> <br/>
  CSRF protection can be done in a couple of ways:<br/>
  1) Verifying the origin of request from header<br/>
  2) Verifying the target of the request<br/>
  3) CSRF token<br/></p>
  
  <p><strong>How CSRF token protection works:<br/></strong>
  The CSRf token in present in the header/cookie. So when the hacker tricks the browser into sending the request to the server, the token is present only in the header and not in form submitted. So when the server goes to check whether the CSRF token received, it tries to match the CSRF token from the header with that received from the form/request. If it's not present/doesn't match then server identifies that it's an attack and stops the request from penetrating further. <br/></p>
  
  <p>Request you all to please correct me if my understanding about the CSRF attack, protection is correct or not ?<br/>
  Also does it mean <strong>without</strong> proper implementation of SSL, CSRF is of no use ?</p>