How does CSRF work?

Question

CSRF

Something I do not quite understand CSRF protection. That is, the essence of protection is that we have an additional token that we send to the server with each request. I have two questions:

1. To send requests to the server, we embed a CSRF token in the form. What prevents an attacker from making exactly the same form, into which the CSRF token from our cookies will be inserted in the same way?

2. How do we make the very first request to the server (authentication) if we don't have a CSRF token yet? Or is authentication allowed without this token?

Answer 1

CSRF token is different every time. The site loaded, a fresh one was substituted in the form. But if you copy it and try to use it from another place, it will immediately go bad.

Answer 2

Did you read and understand everything here? https://learn.javascript.ru/csrf