As far as I understand it, yes. The basic idea is that any requests that do not originate from the domain will not send the cookies, preventing CSRF, clickjack

As far as I understand it, yes. The basic idea is that any requests that do not originate from the domain will not send the cookies, preventing CSRF, clickjacking and the advanced CSRF discussed here yesterday (from stackoverflow: http://stackoverflow.com/q/2669690/3287 http://stackoverflow.com/q/2669690/3287)