CSRF is an attack where a page in a different window/tab of the browser sends nonconsensual request to an authenticated web app, that can typically be prevented from server-side by checking the Referer, Origin header of the request or including anti-CSRF token in request header or body.
CORS is variously defined in different sources, that might roughly be summarized as: a mechanism that host-of-origin-B indicates to the browser how or whether a host-of-origin-A content should access its resources.
Cross-origin-related attacks and party responsible for defence
- Nonconsensual "state-changing" requests: The server.
Be it a treacherous form submission, XHR/fetch request from a "second-origin" page, the server need to recognize and reject them.
- Cross-origin data (credential, privacy) leaking: The browser.
Be it a media tag (img, video, audio), XHR/fetch request, the browser must isolate those data from the access of "second-origin" pages.
- Q1: anythine else?
Purpose of CORS in cross-origin settings
To let browsers make informed decisions on how:
- To make concensual "state-changing" possible cross-origin.
Q2: Is there an real-world example of concensual cross-origin "state-changing" user action?
- To allow "creative" ways of collecting and using of digital assets hosted at "second-origin" host(s) by the script.
Q3: CORS doesn't help browser protect users from malicious digital asset hosts determined to steal data from users? But honest origin servers can prevent them from submitting CSRF requests?