Cross-site request forgery involves:

A malicious user deliberately sending requests from their own browser describes a direct unauthorized access attempt, not CSRF, which requires the victim's own authenticated browser to be the unwitting vehicle.

An intermediary altering traffic in transit describes a man-in-the-middle (MITM) attack, which is a distinct attack class that does not rely on the victim's browser being tricked into initiating requests.

In CSRF, an attacker crafts a malicious link or embedded resource that causes the victim's browser to automatically send an authenticated HTTP request to a target server without the user's knowledge or intent. The browser transparently includes session cookies or credentials, making the server treat the forged request as legitimate. This distinguishes CSRF from XSS - CSRF exploits the server's trust in the authenticated browser, not the browser's trust in a script.

A server making unauthorized requests to another server describes Server-Side Request Forgery (SSRF), a separate vulnerability class where the exploit targets server-to-server communication rather than browser-to-server.