I have the following questions regarding CSRF, SOP and CORS.
Does CSRF tokens only protect form submission with either POST or GET methods? Is this just a "common practice" (regarding the fact that only form submissions are vulnerable like for example POSTing a request to transfer funds in a web banking site)
Is CORS only available (bypasses SOP) when requesting content with a GET method and not with POST? If a form is protected with CSRF token then there is no point in reffering to CORS to make such a request (meaning to submit the form from a different domain) due to the fact that even with CORS enabled there is a CSRF token protecting that content (even if this is not a typical use case of CSRF token).
Is CORS based on checking the origin header due to the fact that the browser of the victim cannot be tricked into spoofing the Origin header? While cURL enables us to spoof headers, in this particular attack the browser of the victim cannot be fooled?
I have read various posts regarding the above but I would love a clearer explanation. For instance I have read that:
However, resource loading from other hosts like images, scripts, stylesheets, iframes, form submissions etc. are not subject to this limitation
What confuses me I think is that most threads regarding CSRF token only elaborate only on examples with forms and posting data with POST method to a server and don't elaborate on the greater picture.