What is the difference between CORS and CSRF?

What is the difference between CORS and CSRF?

CORS (Cross-Origin Resource Sharing) is a security feature that allows or restricts resources on a web page to be requested from another domain. CSRF (Cross-Site Request Forgery), on the other hand, is an attack that tricks the user into submitting a request that they did not intend to make.

How does CORS help prevent CSRF attacks?

CORS helps prevent CSRF by ensuring that only requests from allowed origins can access resources. If a request comes from a disallowed origin, the browser will block it, thus preventing potential CSRF attacks.

Can you give an example of a CSRF attack?

Sure! Imagine a user is logged into their bank account. If they visit a malicious site that sends a request to transfer money from their account without their consent, that’s a CSRF attack. The bank's server might process the request thinking it’s legitimate.

What measures can I take to protect my application from CSRF?

To protect against CSRF, you can implement anti-CSRF tokens, use the SameSite cookie attribute, and validate the origin of requests.