I was reading up on OWASP's page on CSRF and in their example they use a request where the sensitive parameters are stored in the query string:
On my site I make a request where nothing sensitive is stored in the query string:
But if you look at the raw request you can see the sensitive information:
What I'm wondering is if I am safe from CSRF attacks since I do not include any parameters in my query string? If I'm not safe from CSRF, how would a malicious user submit a forged request?