Cross-Site Request Forgery (CSRF)

If you're logged into your bank in one tab, your browser automatically attaches your session cookie to any request to that bank's domain — even one triggered by a completely different, malicious site you have open in another tab. CSRF abuses this: a malicious page silently submits a form or request to a site you're logged into, and your browser happily attaches your real credentials.

The standard defense is a CSRF token: a random, unpredictable value the real site embeds in its own forms and checks on submission. A malicious third-party page has no way to know or guess that token, so its forged request gets rejected even though your session cookie was valid. This is exactly what Django's {% csrf_token %} template tag does automatically on every form in this site.