EXERCISE 1 — The confused deputy framing
=========================================

WHO IS THE DEPUTY:
  - The victim's BROWSER. A "deputy" acts on behalf of someone with more
    authority than the requester. The browser acts on the user's behalf and
    holds the user's authority for the sites they're logged into.

WHOSE AUTHORITY DOES IT HOLD:
  - The user's authenticated session for the TARGET site (e.g. the session
    cookie for yourbank.com). That cookie represents "this is the logged-in
    user" — that's the authority.

HOW IS IT CONFUSED:
  - A malicious, unrelated page (evil.com) initiates a request to the target
    site. The browser, following its normal rule, automatically attaches the
    user's yourbank.com cookie to that request — even though the request was
    triggered by evil.com, not by the user. The browser applies the user's
    authority to an action the user never intended. It has been "confused"
    into using legitimate authority for the attacker's purpose.

WHY THE ATTACKER DOESN'T NEED TO STEAL THE SESSION COOKIE:
  - The browser sends the cookie AUTOMATICALLY on every request to its
    domain (ambient authority). The attacker only needs to cause a request
    to be SENT to the target; the browser supplies the credential for them.
  - The attacker's page never reads the cookie (the same-origin policy and
    HttpOnly flags would prevent that anyway). They don't need its value —
    they just need the action to fire with it attached.
  - So CSRF is an attack on INTENT ("did the user mean to do this?") not on
    AUTHENTICATION ("is this really the user?"). The user really IS
    authenticated; that legitimacy is precisely what gets exploited.

ONE-LINE SUMMARY:
  The browser (deputy) carries the user's authority and auto-applies it to
  any request to the target — so an attacker only has to trigger the
  request, not steal the credential.