CSRF tokens prevent Cross Site Request Forgery by ensuring that requests come from the legitimate application, not from a malicious site. The token is a secret value that attackers cannot include in their forged requests. Options A (XSS) and C (XST) are different vulnerability types.