If an attacker sends a malicious code for state changing event to a victim and the victim opens that malicious link and clicks on the submit button, can the attack take place when the user is not logged in to the attacked web application?

4 Answers 4


Yes it can happen. Many pages do redirect to the login page when a request that require authentication fails due to user not logged in.

If the user is unaware enough, he might try to login thinking that its is a "ordinary" login (and not a login that is caused by a request that require login). In many cases, the login page will then after login, resubmit the request that initially failed. This can either be accomplished by that the request itself is saved in a cookie, or the request may be saved in a session bound to a cookie (like a forum post) and then is posted after user is logged in.

It can be similiar to session fixation attack, but instead the whole malicious request is "fixated" during login.

The resubmitting of failed requests can be seen as a example on many phpBB forums. Lets say you are replying to a thread, and your session expires. You then press on "Post", you are redirected to the login page, and then you re-login. After that, your post is posted, like it was "saved" in the login form. However, phpBB employs CSRF protection. It was just a example on how such a resubmit can happen.

In some rare cases, the request may be saved in a permanent cookie, which make such a "unauthenticated CSRF attack" very dangerous. This is common with webshops, that might save the whole shopping cart in a permanent cookie. If a webshop would save a completed order in a permanent cookie and the webshop employ saved ("recurring payment authorization") credit card, its very possible that a user might visit the CSRF site, press the button, notice nothing happens. Then Days or months later, visit the webshop, and try to login, Voilá, a order is immediately placed due to the permanent cookie - with shipping adress directed at the attacker.


Long answer: Cross Site Request Forgery attacks only apply after authentication as the intention of the attacker is modify a state in a back-end system.

When a user is not authenticated and clicks an attacker's link which is intended perform a CSRF attack, the login screen will appear.

Short answer: No


Assuming that the attack targets a function that requires authentication and there are no other issues such as default credentials or persistent xss, etc then the answer is no. Otherwise the answer is "it depends".


No, the whole idea of csrf is, that an attacker acts on the behalf of an authenticated user. If the user is not authenticated, clicking on the link will result in the same behavior as if the attacker would have clicked it themselves.

Generally, this means that a login screen will be displayed. Depending on the website, it might be possible, that the desired action is executed after login credentials are supplied to the login screen, so if a user enters their credentials, the csrf attack might still work in your example.

But generally, this is not how csrf attacks happen. The user does not need to click a link or a submit button, an attacker will automate the user actions whenever possible*, so that the user does not need to click on anything, and also so that they don't get suspicious.

* HTML is needed for csrf GET requests, and JavaScript for POST requests

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .