title: How do CSRF tokens protect from malicious GET followed by POST in another tab
body: <p>I know I am missing something, but please help me understand. Consider this situation:
  I have a website called goodbank.com. URL <a href="http://goodbank.com/transfer/" rel="nofollow">http://goodbank.com/transfer/</a> serves a HTML page on GET with a form to transfer money to another account.  The form has a random token to prevent CSRF attack. On the server, token validity is checked on POST and the corresponding controller allows only authenticated sessions.</p>
  
  <p>Let's say that in my browser, I login to  goodbank.com/. In another tab, I go to robgoodbank.com. As part of the served page, it has javascript to do AJAX request to goodbank.com/transfer/ to get a valid form. It then fills in other fields in the form and does a POST. My account is cleaned out :(</p>
  
  <p>How does existing protection schemes protect against such an attack?</p>
  
  <p>Thanks in advance. </p>