csrf

Cross-Site Request Forgery: Making the Victim's Browser Do It

The attacker never steals the session. They get the victim's own browser to send an authenticated request, using cookies the browser attaches for them.

Security From the Ground Up04