An action you did not ask for
Imagine you are signed in to your bank. You visit a malicious page, which tells your browser to request a transfer. If your browser automatically includes the bank’s session cookie and the bank does not check that the request is genuine, it may treat the transfer as yours.
The attacker does not need to see the bank’s response; causing the transfer is enough.
How sites check requests
Sites can require a hard-to-guess code called a CSRF token, check where a request came from, and limit when browsers send sign-in cookies on requests started by other sites. Cross-site scripting can bypass some of these safeguards.