I'm reading up on CSRF and I came across synchroniser tokens. I don't understand why you can't do a CSRF to get the token to do a real CSRF.
bank.com has a form like this at
<form action="https://bank.com/do_transfer" method="post"> <input type="hidden" name="synchroniser_token" value="j/DcoJ2VZvr7vdf8CHKsvjdlDbmiizaOb5B8DMALg6s=" > <input type="hidden" name="to" value="ciro"> <input type="hidden" name="amount" value="100"> <button type="submit">Send 100$ to Ciro.</button> </form>
This code adapted from https://stackoverflow.com/a/26895980/1512962
What would stop
malicioussite.com from GETing
authenticity_token? Then, they could use that ID to do a real CSRF, essentially a CSRF to do another CSRF.