On the client side, a http request sent from webpage A that targets website B will cause all cookies belonging to Website B to be sent to B (even when A does not belong to B).
I do not understand why the cookies behavior has been designed this way. Isn't it obviously insure and the root reason behind CSRF (cross-site request forgery)?
I know nowadays "same-site cookie" is on the way. But I want to know what was the motivation of the old insecure design.