A web application has an 'account delete' feature accessible via a GET request: '/api/deleteAccount?id=123'. A malicious website embeds '<img src="https://app.example.com/api/deleteAccount?id=123">'. What is this attack and what is the fix?

• A.CSRF exploiting a state-changing GET endpoint: the img tag triggers an authenticated GET request from the victim's browser using their session cookie. Fix: (1) never use GET for state-changing operations; (2) use POST with CSRF token validation; (3) implement SameSite cookie attributes
• B.Reflected XSS through an unvalidated id parameter: the img tag makes the browser run script taken from the response. Fix: (1) never echo the id value into HTML; (2) apply output encoding for the HTML context; (3) add a Content-Security-Policy with script-src set to self for the application origin
• C.Clickjacking via a hidden frame: the page embeds the delete endpoint in an invisible iframe. Fix: (1) never allow framing from other origins; (2) send X-Frame-Options DENY; (3) set frame-ancestors none in the CSP