CSRF tokens prevent unauthorized actions on behalf of users.
Cross-Site Request Forgery (CSRF) tokens are unique tokens included in forms or API requests to verify that the request is coming from a legitimate source. Without CSRF tokens, attackers could trick a user's browser into executing unwanted actions, such as changing account settings, by exploiting the user's authenticated session.