A cross-site request forgery (CSRF) token lets a server know that a request is coming from auser on that site and not from another website the user is visiting. This is because the token is passed with every request via a hidden form field, preventing malicious sites from acting on behalf of their viewers via CSRF attacks.