CSRF may be possible when an attacker can form a URL, which performs an action on the behalf of an authenticated user. Forming such URLs becomes much more difficult, if unique tokens are included in HTTP requests. Including difficult to predict token in HTTP requests is an effective defense against CSRF attacks.
What to Do
Include unique tokens in HTTP requests when performing sensitive operations to prevent Cross-Site Request Forgery (CSRF).
Why
CSRF may be possible when an attacker can form a URL, which performs an action on the behalf of an authenticated user. Forming such URLs becomes much more difficult, if unique tokens are included in HTTP requests. Including difficult to predict token in HTTP requests is an effective defense against CSRF attacks.