In an XSRF attack, a hacker forces the user to submit a request to a website where they are already authenticated with an authentication cookie. Suppose, for instance, you click a link in an email while your browser is authenticated in the page of your bank, or that you click that link while the browser is closed but last time you provided authentication to your bank's website in the form of a persistent cookie. If, once the hacker page is opened with the email link, that page automatically submits a properly filled out form to your bank's website, then that request will be authenticated, since the active authentication cookie is automatically sent whenever a request to the website of your bank is issued.
Avoiding ...
