Backend & systems·Security and identity
another site makes the user's browser send an authenticated request to yours, and the cookie goes along automatically.
Cross-site request forgery
Also calledCSRF, XSRF, SameSite
An attack exploiting the browser's habit of attaching cookies to cross-origin requests, so a third-party page can act as a logged-in user. Defences are `SameSite` cookies, a synchroniser token, and not accepting state-changing GETs. It does not apply to APIs authenticated by an `Authorization` header, because nothing attaches those automatically.