The document discusses common web application security vulnerabilities such as injection flaws, cross-site scripting (XSS), and cross-site request forgery (CSRF). It defines each vulnerability and explains how CSRF works by tricking authenticated users into submitting requests to vulnerable websites. The document warns that through CSRF, hackers can perform any action an authenticated user can do without restrictions from the same origin policy. It provides recommendations for preventing CSRF including avoiding persistent sessions, using tokens with timestamps, and double authenticating through AJAX.

2. Rasmus Lerdorf “ The Web is broken and it's all your fault.”

3. “ There is no metric for compliance with a 'culture', and a 'culture of security' is overridden by a culture of 'get the job done' every time.” Jon Espenschied

8. “ Same Origin” Policy document, cookies bank.com blog.net XHR XHR TAG TAG JS

11. Trivial CSRF Exploit

12. Exploiting Otherwise Secure Networks

16. Enterprise CSRF Mitigation

17. Questions?