"Why isn't there a header that web servers can give out to browsers basically saying "Don't use the cookie/session I'm giving you ever, unless you're literally on this site"?"
There is, it's relatively new though:
https://blog.mozilla.org/security/2018/04/24/same-site-cooki...
Yes also see my comment about csrf token too. If the request changes user data it must be a POST request with csrf protection.
You can't make POST requests with ajax as CORS will protect you, but evil.com can create a fake form submission (with bank.com/transfer.php as the form's action) which can be a POST request. So in this case you match the csrf token which only you know and which is unique for the form/session.
It's a rabbithole :)
Re:Developers don't understand CORS
by greenshackle2 on Wednesday July 10, 2019 @05:29PM
(#20406764)
It seems you can make a POST request from javascript, as long as it doesn't have non-standard headers or content-type.
Try it yourself: https://news.ycombinator.com/item?id=20406633
EDIT: Why isn't there a header that web servers can give out to browsers basically saying "Don't use the cookie/session I'm giving you ever, unless you're literally on this site"? I could see this being very useful for banks or other origins where they expect no requests except from direct users.