Re:Why do we have both CSRF protection and CORS?
by blincoln on Monday March 03, 2025 @07:23AM
(#43241081)
CSRF tokens are only valid for a particular user, or session, or sometimes even a particular page load.
If there's a way for evil.com to obtain a CSRF token that's valid for an arbitrary user, it's a vulnerability, just like if evil.com could obtain the user's session token, JWT, etc.
If there's a way for evil.com to obtain a CSRF token that's valid for an arbitrary user, it's a vulnerability, just like if evil.com could obtain the user's session token, JWT, etc.