FrontendHaltSecurity·Intermediate·Conceptual·1 min read
Why does CORS not prevent CSRF?
Short interview answer
CORS primarily controls whether another origin's JavaScript may read a response. Browsers can send many cross-origin requests without CORS read permission, so cookie-authenticated state changes still require CSRF defenses.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.