CSRF tokens prevent Cross-Site Request Forgery by including a secret, unpredictable token in state-changing requests. Attackers cannot forge valid requests without knowing this token. CSRF is distinct from XSS (script injection) and XST (HTTP TRACE method abuse).