I was reading some material about the defense mechanisms used to protect against CSRF attacks. I think I've a question about the one based on a secure token.
As far as I know, a web application should be designed to include a secret token, which would block a CSRF attempt. This would work simply because the attacker wouldn’t know such token, hence s/he could not add it into the malicious redirect (I read a nice old summary from a senior user in the forum).
The bit I’m still struggling to grasp is how this works:
If I am indeed logged into that website, what would prevent my browser from adding this secret token to the malicious redirect? (Hopefully, the answer is that it does not, because of the very nature of this token, but I'm just missing how it works)
If I am not logged into that website, the attack would fail anyway, right? (Unless of course a malware has infected the machine and will wake up a “dormant” CSRF attack as soon as it has detected that the target URL has been requested by the user. That’s however beyond the scope of my question)