The BEST methods for a web developer to prevent the website application code from being vulnerable to cross-site request forgery (XSRF) is to: (Select TWO).

Permitting redirection to internet-facing URLs increases attack surface and could facilitate open-redirect attacks that assist CSRF, making the application more vulnerable, not less.

Ensuring HTML tags use angle brackets is a basic HTML syntax requirement and has no bearing on CSRF prevention.

Validating and filtering input on both the server side and client side ensures that requests contain expected, well-formed values, making it harder for a forged request to pass validation checks. Server-side validation is mandatory because client-side controls can be bypassed.

A web proxy passes requests between user and application but does not inherently add CSRF tokens or validate request origin, so it does not prevent CSRF.

Restricting and sanitizing special characters in inputs and URLs prevents attackers from embedding malicious payloads or manipulating request parameters in crafted URLs that could trigger unintended actions on behalf of an authenticated user.