The victim's browser holds a session cookie for bank.com after logging in. A cookie is attached to a request based only on its target domain, not on which page initiated the request — so a hidden auto-submitting form on evil.com can make the browser fire a fully authenticated POST /transfer to bank.com without the user ever knowing.
- CSRF token — bank.com embeds a random, unguessable value in its own forms and checks it server-side on every state-changing request. evil.com can forge the cookie-bearing request but can't read or guess bank.com's page to steal the token, so the request is rejected with 403.
- SameSite cookie — marking the session cookie
SameSite=Lax or Strict tells the browser itself to withhold that cookie on cross-site requests, so the forged POST arrives at bank.com with no session at all.
- Either defense alone stops this attack; production systems typically layer both plus origin/referer checks.