Which of the following are the limitations for the cross site request forgery (CSRF) attack? Each correct answer represents a complete solution. Choose all that apply.

A fundamental limitation of CSRF is that the attacker must know all required form input values in advance. If the server includes an unpredictable anti-CSRF token as a hidden field, the attacker cannot construct a valid forged request, making the attack impossible.

If the target site inspects and validates the HTTP Referer header, it can detect that a request originated from a different domain and reject it. The attacker is therefore limited to targeting sites that omit this check.

Short-lived authentication cookies reduce the window of opportunity but do not prevent a CSRF attack from succeeding during an active session; this is a general session hygiene measure, not a structural limitation of the attack.

Requiring authentication tokens in GET/POST parameters is a defense against CSRF, not a limitation inherent to the attack itself; the question asks for conditions that constrain the attacker, not server-side countermeasures.