It is a special type of token, specially crafted to protect web apps from bad or unauthorized requests. It is also known as a synchronizer or challenge token. It is unique for every web user session. It is checked by the server to determine the legitimacy of a request. They are unpredictable and generated with strong entropy.