Consider the standard CSRF protection of a Ruby on Rails application: a CSRF token is embedded in the HTML page, while at the same time stored encrypted as part of the session cookie. When making a request, the embedded token is sent along the cookie, and the server can then check whether they match.
Suppose now to open the same application in two separate browser tabs. They will have different CSRF tokens and as such different session cookies. However, when I make post requests there are no CSRF issues.
This raises the question: what is the scope of a browser cookie? If the scope were global (i.e. valid across different browser tabs), then as soon as I opened the second tab the first session cookie would have been overwritten (as they come from the same origin and have the same key). But I can make POST requests from the first tab, and they do not fail, implying that each tab has its own set of cookies.
On the other hand, if I log in in one tab and open a second one, I obviously have an application session in the second tab too, implying that cookies are shared across browser tabs.
So then, what is the true "scope" of a browser cookie?