What is Cross Site Request Forgery?

Cross Site Request Forgery (also known as XSRF) works by exploiting the
trust of a users intentions. Site tasks are usually linked to specific
urls (Example: http://site/stocks?buy=100&stock=ebay) allowing a
certain action to happen when visited
by the user. If a user is logged into the site and an attacker tricks
their browser into making a request to one of these task urls, then the
task is performed and logged as the logged in user. Typically you’ll
use Cross Site Scripting to embed an IMG tag
or other HTML/Javascript code to request a specific ‘task url’ and if the user is logged in it will get executed without
their knowledge. These sorts of attacks are fairly difficult to detect potentially leaving a user debating with the
website/company as to whether or not the stocks bought the day before we initiated by the user after the price
plummeted.