CSRF (Cross-Site Request Forgery) tricks a victim’s browser, already authenticated to a site, into sending a state-changing request the user did not intend — because browsers automatically attach cookies to requests for that site. The attacker cannot read the response, but the action still happens.
Worked example: a malicious page auto-submits a hidden form POST to yourbank.com/transfer; because the victim is logged in, their session cookie rides along and the transfer executes. Gotcha: the defenses are anti-CSRF tokens (a secret the attacker’s page cannot know, required on each state-changing request) and SameSite cookies (which stop the browser attaching the cookie to cross-site requests) — CSRF targets cookie-based auth, so token-based (Authorization header) APIs are largely immune.