Web Security · Junior · Question 44 of 75

What is the difference between CORS and CSRF?

1CORS is an attack, CSRF is the defense against it
2They are two names for the same protection
✓Correct answer: CORS controls who can read cross-origin responses; CSRF is an attack that sends unwanted requests with the user's cookies

Explanation

Simple form POSTs are sent cross-origin without any CORS check, so CORS settings alone don't stop CSRF.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.