2 ms·
CSRF tokens are only valid for a particular user, or session, or sometimes even a particular page load. If there's a way for evil.com to obtain a CSRF token th
by blincoln 2y ago
CSRF tokens are only valid for a particular user, or session, or sometimes even a particular page load.
If there's a way for evil.com to obtain a CSRF token that's valid for an arbitrary user, it's a vulnerability, just like if evil.com could obtain the user's session token, JWT, etc.