Comment by preinheimer

I don't understand how this works, if the client is generating the data, why can't the CSRF attacker do the same?