Websites can make a http request to other websites, so websites need to be sure that requests to "buy now" or "add comment" are genuine. https://scotthelme.co.uk/csrf-is-dead/ #webdev