I'm sorry you were mocked, it's a good question. That's an option at the individual site level – and it may be possible to use a CSP policy to enforce that no c

I'm sorry you were mocked, it's a good question. That's an option at the individual site level – and it may be possible to use a CSP policy to enforce that no cross-site requests are made. You can definitely use CSP policy to enforce what domains scripts may be fetched and executed from. However if the standard were changed to disallow CSR in browser implementations then existing sites would be broken, i.e. it would break the web. Sometimes that's worth it, sometimes it isn't, and it's a careful balance between how many sites would be broken vs the impact of the security vulnerabilities that would be prevented. (disclosure, I work at Google, but not on Chrome (any more) and have no particular knowledge of the CSRF cookie change)