If your app identifies users with a cookie, the browser sends that cookie on every request to your domain, even when the request was triggered by a different site. An attacker can build a hidden form on their own page that posts to your app, such as changing an email address or sending a payment. If a victim is logged in, the request looks legitimate.
Apps that store tokens in a header instead of a cookie are less exposed, but many AI-generated apps mix both, or rely on cookies with permissive settings. State-changing routes that accept plain form posts or GET requests are the usual weak spots.
Set session cookies with SameSite Lax or Strict, require a CSRF token or a custom header on every request that changes data, and never change state on a GET request. Framework defaults help, so check that you did not switch them off to silence an error.
Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax