> Servers should protect themselves from CSRF, it shouldn't be the job of browsers to do that. I personally strongly disagree with this point. I believe a web

> Servers should protect themselves from CSRF, it shouldn't be the job of browsers to do that. I personally strongly disagree with this point. I believe a web browser tab should only communicate with one network location, and 3rd party content/requests should be disabled overall. This way we would have a much saner and user-respecting web. So sure i should be able to click a link to turn off my lights using a local address (although why the fuck would i have IoT in the first place? humanity would be better off if IoT just died), but a remote website should not be able to control what i do with other locations without my explicit consent.