title: Does AntiForgeryToken in ASP.NET MVC prevent against all CSRF attacks?
body: <p>Using AntiForgeryToken requires each request to pass a valid token, so malicious web pages with simple script posting data to my web application won't succeed. </p>
  
  <p>But what if a malicious script will first make some simple GET request (by <a href="http://en.wikipedia.org/wiki/Ajax_%28programming%29" rel="noreferrer">Ajax</a>) in order to download the page containing the antiforgery token in a hidden input field, extracts it, and use it to make a valid <a href="http://en.wikipedia.org/wiki/POST_%28HTTP%29" rel="noreferrer">POST</a>? </p>
  
  <p>Is it possible, or am I missing something?</p>