Which of the following is the accurate description of Cross-Site Request Forgery (CSRF)?

CSRF is specifically a request-forgery attack where an attacker tricks a logged-in user into unknowingly submitting malicious requests to a site where they're authenticated, exploiting the browser's automatic credential inclusion. Option B describes XSS (Cross-Site Scripting), C describes offline password cracking, and D describes packet interception/eavesdropping—none of which are CSRF.

Step-by-step Derivation:
CSRF definition breakdown: (1) The attacker creates a malicious site or embeds code elsewhere. (2) An authenticated user visits the malicious site while logged into the target application. (3) The malicious code triggers an HTTP request (GET, POST, etc.) to the target site. (4) Because the user is authenticated, their browser automatically includes credentials (cookies, session tokens), and the request succeeds without the user's knowledge. This is fundamentally a request forgery leveraging the victim's authenticated session, not injection (B), password cracking (C), or network-level interception (D).