Comment by FiloSottile

See the same-site section of https://words.filippo.io/csrf/