Actually as yoghur points out, CORS doesn't protect against CSRF. A token must be passed for any privileged calls. That said, a benefit of CORS is the ability

Actually as yoghur points out, CORS doesn't protect against CSRF. A token must be passed for any privileged calls. That said, a benefit of CORS is the ability to do non-GET methods. So it's safer in the sense of HTTP idempotence, ie you can change server state safely, using POSTs, DELETEs, and so on. You'd still need to pass a token, however. (Of course I meant cross-domain, not cross-browser :).