CSRF protection defends a cookie-authenticated browser session from malicious sites that try to submit a state-changing request on the user’s behalf. Laravel’s web middleware verifies that POST, PUT, PATCH, and DELETE requests include a valid token tied to the user’s session.

Blade forms should include the @csrf directive, which creates the hidden token field. JavaScript clients can send the token in an accepted request header, and Sanctum provides a CSRF-cookie flow for stateful SPAs. CSRF protection is for session-based browser requests; token-based APIs should use appropriate authentication and should not disable validation broadly.