How CSRF works
The browser sends your cookies everywhere. That is the vulnerability.
Browsers attach your session cookies to every request to a site, including requests triggered by someone else's page. If a bank transfer is a plain GET with no token, an attacker's page can fire that GET the moment you visit it — authenticated as you, with no click and no warning.
The defense is proving intent: an unpredictable per-session token embedded in every state-changing form, verified server-side. SameSite cookies add a strong second layer by withholding cookies on cross-site requests. Note what does not help: checking Referer alone is fragile, and POST alone changes nothing — forged forms POST just as easily as they GET.
That was the whole lesson.
A free account adds the interactive part: the marking quiz, the lab if this lesson carries one, live progress, the timed exam, and a certificate employers can verify.