A CSRF token (Cross-Site Request Forgery token) is a security measure used to prevent Cross-Site Request Forgery (CSRF) attacks. CSRF is a type of attack where an attacker tricks a user into performing unwanted actions in a web application while the user is already logged into the application.

The CSRF token is a randomly generated value assigned to each user during their session. This token is typically used in the form of a hidden field in web forms or as part of URL parameters in AJAX requests. When the user performs an action, the web application checks if the submitted CSRF token matches the expected token. If the tokens match, the request is considered legitimate and processed. Otherwise, the request is rejected.

By using CSRF tokens, web applications can ensure that the actions performed originate from the authorized user and not from an attacker attempting to exploit a user's session. This helps to maintain the integrity and security of the application.