Cross-Site Request Forgery

CSRF is an attack that tricks the victim into submitting a malicious request. This type of attack inherits or hijacks the identity and privileges of the victim and performs unauthorized functions and access on the victim's behalf.

For web applications, most browsers automatically include credentials associated with the site, which includes a user session, cookie, IP address, Windows domain credentials, and so forth.

So, if a user is currently authenticated on a site, that given site will have no way to distinguish between the forged request sent by the victim and a legitimate court request.

CSRF attacks target functionality that causes a state change on the server, such as changing the victim's email address or password, or engaging in a financial transaction.

This forces the victim to retrieve data that doesn't benefit an attacker because...