It is often said that url shorteners can be used for cross site request forgery. I recently clicked on a link in a Twitter profile thinking it would take me to a homepage but instead it subscribed me to their YouTube channel.

But I’m not sure I agree with this view because no one is checking the url for every link they click on and there are good ways to defend against the attack.