title: CSRF, Token and Same-Origin Policy explained
body: <p>So I know there are a lot of questions about CSRF (because I have read some of them) but there is one point I still don't understand. Let's imagine the following case:</p>
  
  <ol>
  <li><p>I am logged in(with cookies) on my server where there is a page with a button 'Delete my account'. Which I don't want to press.</p></li>
  <li><p>I visit a hacker's server:</p>
  
  <p>a. My browser requests 'bad.html', which contains JS, with a callback function defined. It also has a script like:(thus avoiding the Same-Origin Policy problem)</p>
  
  <pre><code>var s = document.createElement('script'); 
      s.src = 'url to "deleteAccountPage" of my server?'
      s.src += 'callback=hackerCallback'; 
      s.type = 'text/javascript';
  document.body.appendChild(s);
  </code></pre>
  
  <p>b. Script is "appended" the browser will load the page and then call hackerCallback passing the page HTML text as parameter.</p>
  
  <p>c. With this HTML, the callback can parse the token in there.</p></li>
  <li><p>The hackerCallback now has the token, sends an Ajax request to my server on the "deleteMyAccount" page.</p></li>
  <li><p>My account is now deleted, because the Token, the cookies and even the browser trace matches the ones registered by the server.</p></li>
  </ol>
  
  <p>How do you avoid that behaviour ? I have read things about only allowing certain Headers on my server. This would cut short all Cross-Domain request on my server, however according to this link (<a href="http://blog.alexmaccaw.com/jswebapps-csrf" rel="noreferrer">http://blog.alexmaccaw.com/jswebapps-csrf</a>) it is not enough... (Which I totally believe)</p>
  
  <p>Thansk for the help
  Seba-1511</p>