The same origin policy allows:
- Cross-origin writes are typically allowed. Examples are links, redirects, and form submissions. Some HTTP requests require preflight.
- Cross-origin embedding is typically allowed. (Examples are listed below.)
- Cross-origin reads are typically disallowed, but read access is often leaked by embedding. For example, you can read the dimensions of an embedded image, the actions of an embedded script, or the availability of an embedded resource.
The important part here is "typically" and "Some HTTP requests require preflight".
This means that you cannot perform eg PUT requests even though they are "write" actions, because they require preflight.
Which is also what the OWASP article says: You can't use CSRF with other HTTP methods than GET and POST.
Incidentally, you can use
xmlhttprequest to send out POST requests:
// hosted on evil.com:
var xhr = new XMLHttpRequest();
xhr.open('POST', 'http://example.com/test.php', true);
This will show an error in your browser console about a SOP violation. But the violation is not the POST request (which will be issued), but the potential of reading out the response (which is not allowed).
As the SOP doesn't forbid write actions, it doesn't really relate to CSRF (which is all about write actions). It does however interfere with some CSRF attacks (eg PUT requests or requests with custom headers), so the SOP can be used in CSRF-prevention (eg by checking a custom header or only using PUT requests).