CSRF tokens are unique values added to forms to verify requests originate from legitimate users. When a user submits a form, the server checks the token's validity. In a Java web app, CSRF tokens prevent attackers from performing actions on behalf of users without their consent.