News for hackers. Stuff that matters.

A comment on Why do we have both CSRF protection and CORS?. Parent comment

Re:Why do we have both CSRF protection and CORS? by theogravity on Sunday March 02, 2025 @06:20PM (#43236355)
The CSRF token is usually stored in a cookie. I guess one could try stealing the cookie assuming the CSRF token hasn't been consumed.

But if one's cookie happens to be stolen it can be assumed they already have access to your session in general anyways making CSRF moot.

[ Parent | on HN ]

There are no comments on this comment yet.