Which of the following are the limitations for the cross site request forgery (CSRF) attack? Each correct answer represents a complete solution. Choose all that apply.

If a form has unpredictable fields such as a CSRF token or captcha, the attacker cannot forge a valid request, which directly limits the attack's viability.

Sites that verify the HTTP Referer or Origin header can detect and reject cross-origin requests, so the attacker is restricted to targeting sites that omit this check.

Short-lived authentication cookies are a defensive mitigation that reduces the attack window but are a security recommendation for the target site, not a constraint the attacker must navigate to craft the attack.

Using token-based authentication in GET and POST parameters rather than relying solely on cookies is a CSRF defense mechanism for the site, not a pre-condition limitation imposed on the attacker.