When a user tries to access a site, the browser often automatically includes the credentials in the request, to make the login process more convenient. These credentials may include the user's session cookie, basic authentication credentials, IP address, and Windows domain credentials. The risk inherent in this mechanism is that attackers can easily impersonate the user. Once a user passes the site's identity verification, the site cannot differentiate between a forged request and a legitimate user request.