Dictionary · Hacking Techniques and Methodologies

An attack in which a malicious site causes a browser to submit a request to a site where the user is already logged in. Anti-forgery tokens and SameSite cookies are the usual defenses.

Your browser helpfully sends cookies. A different site must not be able to ride that login into a state-changing request. Tokens that the other site cannot read stop it.

Example: A transfer form requires a hidden token that was issued for that page. A request from another site fails the check.