2 ms·
> it only prevents reading the response, no? > So again, what stops evil.com from sending a request to say transfer 1 BBBBillion dollars to bank.com and includ
by voxic11 2y ago
> it only prevents reading the response, no?
> So again, what stops evil.com from sending a request to say transfer 1 BBBBillion dollars to bank.com and including a CSRF token it gets from visiting bank.com?
It can't read the response from bank.com so it can't read the CSRF token. The token is basically proving the caller is allowed to read bank.com with the user's credentials. Which is only possible if the caller lives on bank.com or a origin that bank.com has allowed via CORS.