CSRF asks the browser where the request came from
Browsers attach cookies to any request, whatever page caused it. Anti-CSRF tokens and SameSite cookies bind each state change to an intent the user actually saw. Cookies travel without asking Browsers attach cookies to a request based on the target’s domain and path, not on whether the page causing the request was the user’s earlier intent. That means a page on an attacker’s origin can make the victim’s browser send a state-changing request — a transfer, a password change — that carries the authenticated session cookie, and the server sees a request that looks like it came from the legitimate user. This is why a request’s mere presence of credentials is not evidence of the user’s intent; the browser is following the cookie rules, not the user’s choice. ...