Question: how do csrf tokens work?
Answer: CSRF token is tied to a non-session cookie The attacker can log in to the application using their own account, obtain a valid token and associated cookie, leverage the cookie-setting behavior to place their cookie into the victim's browser, and feed their token to the victim in their CSRF attack.