Knowledge MaxxingCross-site request forgery
Cross-site request forgery tricks a logged-in user's browser into sending an unwanted request to a site they're authenticated with, without the user intending it.
Prerequisite: Cross-site scripting
What matters
Because the browser automatically attaches the user's existing session cookie, the forged request can look legitimate to the server unless the application specifically guards against this.
Example
A malicious page might auto-submit a hidden form to a banking site, and if the user is already logged in there, their browser sends the request with their real session attached.
Common misconception
Cross-site request forgery does not require stealing the user's password or session token directly; it relies on the browser automatically attaching credentials the user already has.
Recall question
Why does the browser's automatic cookie attachment make cross-site request forgery possible?