cross-site request forgery

CSRF abuses the browser's automatic credential attachment: an attacker-controlled page makes a request to a target site, and the user's session cookie rides along whether or not the user clicked anything intentional.

The labs cover classic CSRF, token-based defenses and how to bypass them (referer checks, double-submit cookies, predictable tokens), SameSite cookie behavior, and chained CSRF + XSS exploitation.