Cross-site request forgery (CSRF) makes your browser send a request to a site where you are signed in, from a page you merely visited. Your cookie goes along, so the site believes you meant it.