CSRF (Cross-Site Request Forgery) makes a browser send an unwanted request to a website where its user is already signed in. For Joomla, this matters when saving data or performing account actions.
Why forged requests can work
A browser may automatically attach cookies to a request. If the server treats a valid session as sufficient proof of intent, an action can run without the person's agreement. An attacker need not know the password or read the response.
Protection in Joomla
Joomla forms use a token that the server validates before performing an action. Extension developers must both include the token and check it in the request handler. AJAX requests also need the required validation data.
Ordinary GET requests should not change state. SameSite cookies and request context checks provide additional protection. Switching to POST alone does not replace token validation.
Practical checks
After changing Joomla forms, test successful submission with a valid token and rejection when it is missing. A cached form with an expired token can cause errors for legitimate visitors. Disabling validation is not a suitable fix.
CSRF differs from XSS, which runs unwanted code in the page context. CSRF protection also does not replace permission checks for the requested operation.
Conclusion
CSRF protection validates requests within a session. Reliable handling combines tokens, suitable HTTP methods and authorisation checks.