title: Why XSRF token is not being sent on cross-origin?
body: <p>This is a snippet from the file http.js in the Angularjs 1.6.4 on github:</p>
  
  <pre><code>var xsrfValue = urlIsSameOrigin(config.url)
      ? $$cookieReader()[config.xsrfCookieName || defaults.xsrfCookieName]
      : undefined;
  if (xsrfValue) {
      reqHeaders[(config.xsrfHeaderName || defaults.xsrfHeaderName)] = xsrfValue;
  }
  </code></pre>
  
  <p>Why is the XSRF token included only if the request is meant for the same origin? What if a Restful backend is on a different host than the frontend, shouldn't XSRF be used nevertheless?</p>