CSRF
Also called cross-site request forgery
Another website makes your visitor's browser send a request to your site. The browser attaches their cookie automatically, so your server sees a logged-in user asking to do something they never asked for.
The attacker never sees your site or the response, and no password is stolen. A route that changes data and trusts the cookie alone can be fired from any page they happen to visit.
Say it to your agent
“Reject any request that changes state when Sec-Fetch-Site is cross-site, set SameSite=Lax on the session cookie, and move the delete action off GET. Add a test that sends the cross-site header and expects 403.”