Cross-Site Request Forgery tricks an authenticated user's browser into submitting an unwanted request to your app. Mitigation involves generating a unique, unpredictable CSRF token per session (or per form), embedding it in forms, and validating it server-side on every state-changing POST/PUT/DELETE request.
Additional layers like SameSite cookies (SameSite=Lax or Strict) further reduce cross-origin request risk by restricting when cookies are sent with cross-site requests.