Day 7 — Cross-Site Request Forgery (CSRF) in Flask: Account Takeover via Session Riding & Proper Mitigation

During a hands-on web security practice series, a deliberately vulnerable Flask-based authentication system was developed to evaluate whether standard authentication mechanisms sufficiently protect sensitive actions. The analysis revealed that authentication alone is inadequate, as it enabled an attacker to perform an account takeover by changing the administrator's password without knowledge of credentials, session cookie theft, or login bypass. This vulnerability stemmed from the application's implicit trust in browser-attached session cookies, exploiting the browser's automatic inclusion of credentials in cross-origin requests. This technical write-up details the vulnerability's root cause, exploitation methodology, impact assessment, and secure remediation strategies. It incorporates insights from established security standards such as OWASP guidelines, Flask-specific extensions like Flask-WTF, and real-world CSRF incidents to provide a comprehensive analysis suitable for security