title: CSRF using AJAX. Why is it possible?
body: <h3>Steps to reproduce:</h3>
  
  <ol>
  <li>Go to <a href="https://stackoverflow.com/">https://stackoverflow.com/</a></li>
  <li>Open developer console in your web browser</li>
  <li><p>Execute the following JS code:</p>
  
  <pre><code>fetch(`https://webhook.site/5a6f8001-3646-4b3e-bd76-a4562af5a9ef`, { credentials: 'include' })
  </code></pre></li>
  <li>Go to <a href="https://webhook.site/#!/5a6f8001-3646-4b3e-bd76-a4562af5a9ef" rel="nofollow noreferrer">https://webhook.site/#!/5a6f8001-3646-4b3e-bd76-a4562af5a9ef</a></li>
  </ol>
  
  <p>You should see the HTTP request on <a href="https://webhook.site" rel="nofollow noreferrer">https://webhook.site</a></p>
  
  <p>Why does the HTTP request reach the server?
  Does this violate Same Origin Policy?</p>