CSRF tokens/protection?

I’m not able to find any information how to introduce CSRF tokens/protection. Is it possible? Since forms is a key feature it should be supported natively.