> Thankfully, CORS lets modern browsers go cross-browser > safely, even with private data if things are configured right. CORS does nothing to prevent CSRF at

> Thankfully, CORS lets modern browsers go cross-browser > safely, even with private data if things are configured right. CORS does nothing to prevent CSRF attacks, see[1]. We still need to protect against CSRF. [1]http://www.w3.org/TR/cors/#security http://www.w3.org/TR/cors/#security