CSRF tokens prevent unauthorized commands by embedding a token in forms or headers. This token must match the server's session token, ensuring that actions are performed by legitimate users. In a web app, each form submission might include a hidden CSRF token for validation.