Same Origin Policy does not prevent origin
foo.bar from creating a form with action attribute set to another origin
If AJAX requests originating from
canvas objects are subject to Same Origin Policy and not allowed to access the response, why aren't form submissions/XHR requests simply disallowed? What is the reasoning behind this allowance?
I know endpoints accepting the
GET request method can be exploited by images as well, but this question is about
POST and similar method forms only. Wouldn't the need of CSRF tokens vanish if SOP didn't permit cross-origin form submission? What purpose does cross-origin form submission serve?