An attack that tricks a logged-in user into unknowingly performing an action on a website (for example changing a password), for instance by clicking a forged link. It is prevented by secret tokens in forms and by the SameSite cookie flag.
FAQ / Glossary