CSRF can be avoided by using a hidden field to create a unique token that is transmitted in the body of the HTTP request rather than in the URL, which is more vulnerable to disclosure. To protect against CSRF, the user must be forced to re-authenticate or prove that they are users. Take, for instance, CAPTCHA.