Cross-site request forgery prevention is all about cross-domain browser security policy. A CSRF attack looks something like this: 1. Victim visits Evil.com.

Cross-site request forgery prevention is all about cross-domain browser security policy. A CSRF attack looks something like this: 1. Victim visits Evil.com. 2. Evil.com auto-submits a form to http://www.ExampleBank.com/transfer-money http://www.ExampleBank.com/transfer-money with parameters {"recipient": "attacker's account ID", "amount": 1000000} 3. If ExampleBank.com fails to prevent CSRF attacks, the user will unwittingly transfer $1 million to the attacker. The technique described in the article would successfully block this attack: 1. Victim visits Evil.com. 2. Evil.com auto-submits a form to http://www.ExampleBank.com/transfer-money http://www.ExampleBank.com/transfer-money with parameters {"recipient": "attacker's account ID", "amount": 1000000} 3. ExampleBank.com observes that request doesn't contain a correct token parameter, so rejects the request. Evil.com could not fetch the token themselves by curl or any other means: the token is tied to the user's account, so Evil.com would have to send the request on the client-side in order to send the request with the user's cookies. And, since Evil.com is not ExampleBank.com, the request would successfully send but cross-domain security policy would prevent Evil.com from reading the response. Therefore, only ExampleBank.com can access the token, so only ExampleBank.com can send authorized requests.