CORS (cross-origin ressource sharing) can be used to protect webapps from CSRF, before accepting a request, the server verifies that the host specified in the Origin header is among the hosts allowed in CORS Access-Control-Allow-Origin header.
if so, then can we bypass the CORS protection by setting a custom Origin header in the CSRF exploit ? example :
<?php
header('Origin: www.already-allowed-website.net');
/* the rest of a simple POST CSRF exploit... */
?>
No, because you're adding a header to a response, not to a request: when loading your CSRF page, your browser would see a response which was something like:
HTTP/1.1 200 OK
Date: Mon, 11 Sep 2017 09:42:49 GMT
Connection: close
Origin: www.already-allowed-website.net
... web page content ...
The "Origin" header doesn't make any sense in this context, but you can add it via PHP or other server side languages if you want to.
Then the browser would construct the actual CSRF payload, and send a request with whatever Origin header the browser wanted to set, hopefully ignoring any attempts to override it.
There is a list of what headers you can set in XHR requests at https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS
Origin is only set by clients, in requests. This is usually the browser, and it simply ignores any attempts by website code to set it - it might set it to a browser selected value, or not set it at all, depending on context. This is usually before the Access-Control-Allow-Origin header is known to the client - although it's fairly common for Access-Control-Allow-Origin to reflect the value provided in Origin, the reverse of your scenario.
Access-Control-Allow-Origin contain good.com, and a request if about to be sent from evil.com, in this case the client browser will not send the request or he will send it and then the server will reject it ?
It does not matter what Origin header you set in the response from the server to the browser as you do in your example with server-side PHP code. The browser does not care about this header.
Relevant for CORS is only the Origin header sent by the browser to the server. If you would be able to fake this from inside the browser you could bypass the protection. But, Origin is one of the headers which can not be changed within XHR or similar requests so such a bypass should not be possible.
