CSRF stands for Cross-site request forgery. It is a technique hackers use to hack into a web application. Unlike XSS CSRF does not try to steal your information to log into the system. CSRF assumes that you are already logged in at your site and when you visit say comments section of some other site then an attack is done on your site without you knowing it. Here is how it might work. You log in a
![CSRF and Rails](https://cdn-ak-scissors.b.st-hatena.com/image/square/df7dcf3e382d2d4b018ba79fc6642260e3fa7070/height=288;version=1;width=512/https%3A%2F%2Fres.cloudinary.com%2Fdpc4i4bdx%2Fimage%2Fupload%2Fbigbinary_blogs%2Fdefault_blog_image.png)