The story
Initialism of Cross-Site Request Forgery + token.
Etymology from Wiktionary, CC BY-SA 4.0.
Today it means: A secret value added to a web form by the server and sent back by the user as part of a POST request, used to prevent cross-site request forgeries by making sure that the user sending the POST request has actually loaded the form. Full definition →
Initialism of Cross-Site Request Forgery + token.
Etymology from Wiktionary, CC BY-SA 4.0.