First of all, I'm quite new to web security so this might be a dumb question. Also English is not my native language so there might be some errors.
I understand that by having a csrf token as a hidden parameter in a form or HTTP header, an attacker cannot use something like an image tag to perform an action on the user's behalf. I also understand that if you have an XSS on the website, you can steal the csrf token and perform any action.
What I don't understand however is what prevent an attacker to his own domain, like evilsite.com, use JavaScript to make a GET request, analyses the response, extract the csrf token and submit the form to make some action. As you can make a post request with JQuery for example, you should be able to send the request and trick the user.
There should be a mechanism that I don't understand here because it makes no sense for me right now. What don't I understand?
