I'm surely missing something in the picture of how CSRF attacks and protections are working.
My understanding in a form-submit scenery is the protection rely on a unpredictable token, someway is assumed the attacker can't get the token, why?
If the attacker is good enough to make me submit a form (as mentioned by OWASP) what would prevent him from getting the token before submitting?
Forgive me for being pedantic but I'm trying to use CSRF protection on a php server and I may setup it wrong if I don't understand.
Regarding the OWASP's POST scenario example with submit onload,
evil.com is the site the attacked user is visiting right? It will fire a post submit to the
targetSite.com, the javasript onload in the example is simple but it could have been complex using a
get of the form with the secret token before submitting, is that right?
If this is the case, is just the Same-Origin-Policy protecting the attacked user?