CROSS-SITE REQUESTS

Summary from the TLDR Web Dev newsletter

By default, browsers allow cross-site write requests but restrict cross-site reads, a behavior governed by the Same-Origin Policy. CORS is a mechanism to selectively allow cross-origin requests, while CSRF protection uses tokens to verify the legitimacy of requests. CSRF protection is especially important for simple POST requests allowed cross-site.