How to protect yourself from CSRF?

Question

CSRF

Good afternoon.
So I want to protect myself from CSRF, I read it, I decided to make a hidden field and generate a token there, save it to the session and then check it on the server with what came. Only one thing worries me, unless the request that will come from an attacker, for example from an iframe, will not have a session that is created when the form appears?

Answer 1

He can and will have a correct session, but an attacker will not be able to indicate the correct (coinciding with what is recorded in the session) token in the form, because he has no way to recognize it.