Actions triggered from elsewhere.
WHAT IT IS
Another site causing a visitor's browser to perform an action on yours, using their existing session.
WHY IT WORKS
The browser sends cookies with requests regardless of what initiated them.
WHAT IT ALLOWS
Changing settings, making purchases, transferring things, as the legitimate user.
WHAT PREVENTS IT
A token issued with each form and verified on submission.
WHY
Another site cannot read your token.
WHAT FRAMEWORKS PROVIDE
Protection enabled by default.
WHAT TO NEVER DO
Disable it to make something work.
WHAT ELSE HELPS
Cookie settings restricting cross-site sending.
WHAT ELSE MATTERS
Using the correct request method.
WHY
A retrieval that changes state can be triggered by a link or an image.
WHAT THAT MEANS
Never let a retrieval alter anything.
WHAT TO DO FOR APIS USING TOKENS RATHER THAN COOKIES
The risk differs, but verify the request origin where relevant.
WHAT TO TEST
Submitting without the token, and confirming rejection.
