title: How to does the token prevent csrf attack?
body: <p>I have read about CSRF and how the Unpredictable Synchronizer Token Pattern is used to prevent it. I didn't quite understand how it works.</p>
  
  <p>Let's take this scenario :</p>
  
  <p>A user is logged into a site with this form:</p>
  
  <pre><code>&lt;form action="changePassword" method="POST"&gt;
     &lt;input type="text" name="password"&gt;&lt;br&gt;
     &lt;input type="hidden" name="token" value='asdjkldssdk22332nkadjf' &gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>The server also stores the token in the session. When the request is sent it compares the token in the form data to the token in the session.</p>
  
  <p>How does that prevent CSRF when the hacker can write JavaScript code that will:</p>
  
  <ol>
  <li>Send a GET request to the site</li>
  <li>Receive html text containing the request form.</li>
  <li>Search the html text for the CSRF token.</li>
  <li>Make the malicious request using that token.</li>
  </ol>
  
  <p>Am missing something?</p>