Which of the following are the limitations for the cross site request forgery (CSRF) attack? Each correct answer represents a complete solution. Choose all that apply.

Short-lived authentication cookies reduce the window of opportunity for CSRF exploitation but represent a server-side defense mechanism, not a prerequisite constraint the attacker must satisfy to launch the attack.

If the target site validates the HTTP Referer header to confirm the request originates from its own domain, the forged cross-origin request will be blocked, so the attacker is limited to sites that omit this check.

Requiring authentication parameters in GET or POST fields rather than relying solely on cookies is a recommended CSRF mitigation technique, not a limitation that defines the conditions under which an attacker can execute the attack.

A CSRF attack requires the attacker to construct a fully valid request, including all form field values such as hidden tokens; unpredictable or random fields (like CSRF tokens) prevent the attacker from forging a working request.