They verify the legitimacy of requests by matching tokens.
CSRF tokens are unique and user-specific, included in each request to verify it originated from the authenticated user. When a request is made, the server checks the token's validity, ensuring it's not a cross-site request. In Java applications, Spring Security automates this process, protecting sensitive actions like fund transfers.