Session Management - CSRF Attacks

I decided to skip some of the sections about cookies and directly go to the CSRF attacks simply because I have no previous experience with these attacks and would like to know more about them. OWASP Defines these attacks as ones "which forces an end user to execute unwanted action on a web application in which he/she is currently authenticated". So basically, we trick the admin into executing harmful code. The concern with this exploit is that often times the admin does not even know he or she is being tricked into executing code.  In fact, even going to a simple and relatively safe website can cause the code to execute.  How does this work?

Let's a you get an e-mail telling you to visit a website. The website has the following code:

<img src=”https://domain.com/picture.gif” width=”0” height=”0”>

Seems harmless right?  Well, domain.com/picture.gif can easily be redirected to http://baddomain.com/badCode.

How do web prevent this from happening?

OASP Recommends the following actions.

• Logoff as soon as your done administering.

• Don't allow your browser to save usernames & passwords

• Do not use the same browser to access sensitive information as you use to surf freely on the internet.