I noticed tokens used in form submissions to prevent CSRF attacks, though in 2016 a lot of people are moving to JS frontend & restful API backends. I'm puzzled, with this approach is there no need for CSRF tokens anymore?
I think CSRF is an issue on form submissions since all the session data is sent with every request. But is AJAX different? I.e. all cookies (session data) are not sent?
You can assume my API is protected by CORS (over TLS), i.e. Access-Control-Allow-Origin is set only for the site I expect data to be collected from.
So what I am asking is: Is CORS & an AJAX API call the way to avoid generating tokens in my front end code?