An anti-CSRF token is a secret, unpredictable value attached to a session or form and required for state-changing requests such as edits, account changes, or deletions. CSRF stands for cross-site request forgery: an attack where a victim’s browser is tricked into sending a request they did not intend. By checking that the request includes the correct token, a server can confirm the action came from an authorized client that actually loaded the legitimate page or API flow.
These tokens matter because they protect write paths, not just logins. In practice, platforms like content management systems, webmail, and wiki software use them to block forged submissions from malicious sites or automated tooling. An attacker who only has a session cookie may still fail if the token is missing or invalid. Defenders use token validation alongside authentication, rate limiting, and logging to reduce unauthorized changes. Anti-CSRF tokens do not stop all abuse, but they make silent, cross-site write attacks much harder.