CSRF

In CSRF an attacker page submits a form or fires a request to your site. The browser attaches the victim's cookies, so the server sees an authenticated request it never intended to receive: change email, transfer funds, add an admin.

Defences, best used together: SameSite cookies; a synchroniser or double-submit token checked on every state-changing request; rejecting requests whose Sec-Fetch-Site header is cross-site (Fetch Metadata); and never changing state on GET.

APIs that authenticate with an Authorization header rather than cookies are not exposed to classic CSRF. Login CSRF (forcing the victim into the attacker's account) is often forgotten, as is OAuth's state parameter, which exists for the same reason.