Cross-Site Request Forgery (CSRF) is a security vulnerability where a rogue site tricks a user into submitting form data to a legitimate server without their knowledge. This occurs because the browser automatically sends the user's session cookie with each request, allowing attackers to exploit the victim's authenticated session.
The defense mechanism generates a unique random token stored in the session. Every form submitted by the legitimate server includes this token in a hidden input field. Upon receiving a form submission, the server checks the token against the session store. If the tokens do not match, the request is rejected. Django provides built-in CSRF protection by default when session middleware is active.