How CSRF attacks work

cross-site request forgery