It works because browsers attach cookies automatically. Defences: SameSite cookies and a per-session token that must be sent in a header or form field.
CSRF
Cross-site request forgery: another site makes the browser send an authenticated request you did not intend.