A fake page could post a change to my logged-in user. The browser sends cookies to any form, so the server must check the request came from you.
About 1 min of reading
Require a token a cross-site page cannot supply.
A forged form without the token is rejected by the server.
Before you run it, say out loud what it will print. Then open the answer.
The real form includes the session token, so it succeeds.
Before you run it, say out loud what it will print. Then open the answer.
A cross-site form gets your cookies automatically, so cookies alone do not prove the request is yours. A CSRF token is a secret the attacker's page cannot read, required in the request body. That is the proof.
SameSite=Lax/Strict stops the browser from sending the cookie cross-site, closing most cases. It is not the whole answer for top-level navigations or older browsers, so keep the token for state-changing requests.
<form action='https://yoursite/change' method='POST'>A page on another origin can submit a form to your endpoint. The browser attaches your session cookie, so the change runs.
session_token = random()
form needs session_token in the bodyPut a random value in the form that a cross-site page cannot read. The attacker cannot copy it, so the forged request fails.
Set-Cookie: session=...; SameSite=LaxSameSite stops the browser sending your cookie on a cross-site POST. It is the cheap first layer under the token.
Each one is defined here on this site. Open the entry for the full definition and the other words it points at.