CSRF (Cross-Site-Request-Forgery) attacks work by sending arbitary (form) requests from a victim.
The receiving site (in our case the Controller who processes the form data) doesn't know where the data comes from.