I'm trying to learn about CSRF Attack and having a hard time understanding that.
My understanding is, An attacker can maliciously make a request to the user via hidden value in his website to make a request to Bank website to transfer funds. The browser sends all cookies along with that request initialed maliciously via Attacker.
My question is, Can the attacker see cookie contents like Session ID or some Data stored Inside Cookie?
When the targeted application does not properly validate the origin of the request a Cross Site Request Forgery attack is possible.
It is an attack which forces end users to execute undesired actions on a web application in which they are currently authenticated.
Due to the nature of web browsers, all cookies are transmitted in the malicious request to target the web application.
Can the attacker see cookie contents like Session ID or some Data stored Inside Cookie?
No, this is not possible in a Cross Site Request Forgery attack. However, if a Cross Site Scripting attack is also possible this may be possible depending on the cookie's attributes (e.g. HTTPOnly)
