> Right, this seems like a very bad idea and now everyone has to do CSRF because of it? Yep, that pretty much sums it up. CORS doesn't have to enter into it t

> Right, this seems like a very bad idea and now everyone has to do CSRF because of it? Yep, that pretty much sums it up. CORS doesn't have to enter into it though: evil.com just has no way to read the CSRF token from bank.com, it's a one-time password that changes with every form (one hopes) and it's embedded in places that it can't access. It can send an arbitrary POST request, but no script originating from evil.com (or anywhere that is not bank.com) can get at the token it would need for that post to get past the CSRF prevention layer.