The protection provided by this technique can be thwarted if the target website disables its same-origin policy using one of the following techniques:
Permissive Access-Control-Allow-Origin Cross-origin resource sharing header (with asterisk argument) ...
Is that correct?
How does a
Also if the value is * then withCredentials is automatically false (https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials)
And even if it was possible, XHR doesn't allow you to read another domain's cookie, even if successfully set (https://fetch.spec.whatwg.org/#forbidden-header-name)
Is that claim wrong or perhaps I'm missing something? Or maybe the article meant that this in combination with the other items together is needed to thwart this method?
EDIT To clarify, the Cookie-to-header-token does not include a hidden input field, just a Cookie.