CSRF relies on HTTP stateless request, uses HTML to force the attracted browser to submit the request, so as to achieve the attack purpose. CSRF is hard to be found and has great harm. This paper deeply studies the principle of CSRF and the protective measures, strives to minimize the CSRF damage.