Re:Why do we have both CSRF protection and CORS?
by hombre_fatal on Tuesday March 04, 2025 @03:26PM
(#43259483)
The key is that CSRF is protecting against the browser's automatic behavior of sending cookies along with cross-origin requests.
A form on evil.com posted to bank.com does send your cookies by default.
But not for fetch() in the browser. And certainly not for a request made from evil.com's server.
Also, bank.com would want to create CSRF tokens tied to current user. Or ensure its CORS protections never allow cross-origin requests (the default) if it were to use generic CSRF tokens.
A form on evil.com posted to bank.com does send your cookies by default.
But not for fetch() in the browser. And certainly not for a request made from evil.com's server.
Also, bank.com would want to create CSRF tokens tied to current user. Or ensure its CORS protections never allow cross-origin requests (the default) if it were to use generic CSRF tokens.
Or just use same-origin cookies.
Or don't even use cookies at all.