How do cookies relate to CSRF?

The answer

Browsers attach cookies automatically, so a malicious page can trigger a request that carries the victim's session cookie, which is the heart of CSRF. MDN lists three main defences: CSRF tokens embedded in the page, checking Fetch metadata headers such as Sec-Fetch-Site, and requiring requests that are not simple. The SameSite attribute then adds defence in depth. Never change state on GET requests, because Lax still lets top-level GET navigations carry the cookie.