CSRF, CORS, and HTTP Security headers Demystified
CSRF, CORS, and HTTP Security headers Demystified mybank.com/transfer-funds. Since you are logged in to mybank.com, this request is made with your mybank.com cookies and will silently initiate a money transfer out of your account. Since ' mybank.com' are different origins, the browser refuses to provide the response to evil.com (because of CORS), but the attacker doesn't care, the money's already been transferred. Now if Each time mybank.com serves a form to a user, it generates a CSRF token and inserts it into a hidden field in the form If a POST request is received,...
Source: vnaik.com