A cross-site request forgery (CSRF) vulnerability occurs when
If the request does not contain a nonce that proves its provenance
The application acts on an HTTP request without verifying that the request was made with the user's consent
A Web application uses session cookies
All the above