Answer:
cookies
Explanation:
For a cross-site request forgery attack. the attacker needs to get hold of a reproducible web request, which get performed certain action like changing of the password. If the request is sorted out by the attacker, then he/she can make a link that gives rise to a malicious request and that link can be put on the page, that is controlled by the attacker. And this is located in a manner that even victim click is not necessary. Once, the victim clicks the link, the browser on its own includes a cookie that is used by that website, and sends the request to the webserver. The web server does not find out the forgery as the request is from the user who is logged in and has sent with request a requisite cookie. And the link can be placed anywhere on any page, in control of the attacker.
