A CSRF defence in which a random token is sent to the browser both as a cookie csrf and as a hidden POST parameter, and the server compares the two on each state-changing request. A match means the party that submitted the form also holds the cookie, which a pure cross-site attacker cannot do — they can forge a POST with any body, but cannot set a cookie for bank.com.
The assumption “an attacker cannot set a cookie for bank.com” is only true for cross-site attacks. A same-site attacker can toss a csrf cookie onto bank.com with a value they know, then POST from their subdomain — the two csrf values match and the defence falls. Use the synchroniser token pattern when same-site attackers are in scope.