Cross-Site Request Forgery (CSRF)

When it applies

A state-changing action authenticated purely by an ambiently-sent credential (cookie) with no unpredictable token the attacker's site can't know/replay.

Why it works

Browsers attach cookies to cross-site requests automatically. If the server accepts the action on cookie alone, an attacker page can submit it on the victim's behalf. Anti-CSRF tokens / SameSite cookies break this by requiring something cross-site JS can't supply.