A CSRF token is a unique, secret value sent with user requests to verify authenticity. The server checks this token, ensuring that the request is from a trusted user and not a malicious third party. In Spring Security, CSRF protection is enabled by default.