CORS vs CSRF

Subtitle: One blocks reads. One forges writes. Left column - CORS: Browser rule for cross-site reads Server sends Allow-Origin header Blocks the page, not the request Guards your data from other sites Failure shows a console error Right column - CSRF: Attack that rides your cookies Another site makes a write for you The request is real, intent is not Stopped by tokens and SameSite Failure shows money moving Simple difference: CORS = who may READ my response CSRF = who may WRITE with my session Use it when - CORS: Front end sits on another origin Use it when - CSRF: Any cookie-authed state change Sticky note - Common beginner mistake: Adding CORS headers to stop CSRF. CORS never stops the request from being sent - the server already ran it.