The core

CSRF rides your login without stealing it.

The attacker never sees your password or session. They just get your browser to fire a request at a site you're logged into — and the browser attaches your cookies automatically.