CSRF

An attack that tricks an authenticated user into submitting unwanted requests.

CSRF tricks an authenticated user's browser into sending an unwanted request to a site where the user is already logged in, abusing the automatic inclusion of session cookies to perform actions without consent. It targets state changing operations such as transfers or password changes rather than data theft. Anti CSRF tokens, SameSite cookie attributes, and rechecking user intent are standard defenses. It is often contrasted with XSS, which injects and runs script, whereas CSRF rides an existing trusted session.