Browser & Web Performance · Senior · Question 41 of 75

Does a correct CORS configuration protect an API from CSRF?

1Yes, if Access-Control-Allow-Origin is not *
2Yes, CORS blocks all cross-origin requests
✓Correct answer: No: CORS controls reading responses, while CSRF is about sending state-changing requests, which simple requests can do

Explanation

Only non-simple requests are blocked by a failing preflight. Requiring a JSON content type or a custom header helps, plus SameSite and tokens.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.