First of all, I'm quite new to web security so this might be a dumb question. Also English is not my native language so there might be some errors.

I understand that by having a csrf token as a hidden parameter in a form or HTTP header, an attacker cannot use something like an image tag to perform an action on the user's behalf. I also understand that if you have an XSS on the website, you can steal the csrf token and perform any action.

What I don't understand however is what prevent an attacker to his own domain, like evilsite.com, use JavaScript to make a GET request, analyses the response, extract the csrf token and submit the form to make some action. As you can make a post request with JQuery for example, you should be able to send the request and trick the user.

There should be a mechanism that I don't understand here because it makes no sense for me right now. What don't I understand?

  • 1
    The best answer: try to do it yourself! It's not a hard experiment and you'll learn a lot. Aug 13, 2019 at 23:58

1 Answer 1


Same-origin policy prevents a website from reading another website, which also prevents it from extracting the token to perform a CSRF attack.

  • 1
    So if I understand this correctly, we have to trust the browser as this is client-side. Am I right?
    – o2640110
    Aug 14, 2019 at 0:19
  • @o2640110: That's right. Aug 14, 2019 at 0:21
  • Is there a way to do a server-side check to add further protection? (Other than the csrf token)
    – o2640110
    Aug 14, 2019 at 9:35
  • @o2640110 Some people check the referer, but an attacker could force the browser to not send that header. Note that the CSRF provides enough protection already. Aug 14, 2019 at 9:38
  • Thanks a lot for all your answers.
    – o2640110
    Aug 14, 2019 at 14:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .