I am able to make cross site requests because I have enabled CORS. I read about CSRF vulnerability which is caused by the fact that browser sends cookie when making a form POST request.
I tried to exploit my website to see if it works. Therefore, I tried with something simple first. I sent a cross-site GET request but no cookie was sent. So, my question is do browsers not send cookies at cross site GET request or is it that I did something wrong?