> CORS doesn't block the underlying GET/POST request It does block ALL requests for certain content types. In the common cross origin case of a JSON API, CSRF

> CORS doesn't block the underlying GET/POST request It does block ALL requests for certain content types. In the common cross origin case of a JSON API, CSRF beyond CORS is unnecessary.