CSRF (request forgery)

CSRF takes advantage of the fact that you are logged in. The attacker gets you (for example via a crafted link) to send a request that your browser carries out with your privileges, for example changing settings or creating an account.

This is prevented by so-called CSRF tokens: hidden, one-time values attached to forms that confirm the action was deliberately performed by the user, not by a third-party site.