#csrf

CSRF: making the browser betray its user

How cross-site request forgery uses a browser's own cookie-sending rules to trigger actions a logged-in user never asked for, and how to actually stop it.