Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

2
  • 'Same Origin Policy (SOP) preserves the data of other domains and therefore nulls out the use of CSRF.' Same Origin Policy only prevent that data recieved by making request to other domain is not accesible to javascript, suppose there is some website mygov.com, and it lets you vote if you are login, and send some request mygov.com/?vote=1, now if another website has this link embedded then inspite of SOP, the vote will be registered. As the request will modify server state and no need to see the data given back. I hope I am clear. Commented May 3, 2018 at 18:26
  • Same Origin Policy only applies to XMLHTTPRequest This is incorrect. Commented May 6, 2018 at 10:11