15 ms·What stops an attacker from requesting the CSRF token?by kogir 11y agoWhat stops an attacker from requesting the CSRF token?r1ch 11y agoSame-origin policy.kogir 11y agoThat only applies to browsers. I can request it from my server just fine. See https://news.ycombinator.com/item?id=11178922 https://news.ycombinator.com/item?id=11178922