Skip to content

DEV Community

Discussion on: Understanding CORS

View post

Replies for: Do we need CSRF protection if CORS is disabled (now allowed from other domains) ? For me it seems logic that is no need for CSRF protection if CORS...

Maximilian Burszley • Nov 20 '19

You should protect against CSRF on any inputs that can change state imo.

All In Developer • Nov 20 '19

CSRF is Cross-site request forgery
CORS is Cross-origin resource sharing

If no one from another origin is able to make requests to your site (CORS disabled),
then CSRF is redundant imo.

Maximilian Burszley • Nov 21 '19

But that's not what CORS does. Re-read the warning in the article.