The synchronizer token pattern is the most effective protection against CSRF attacks. I understand the theory and implementation, but I do not understand why it can't be circumvented.
Generally, the process requires you to visit a malicious site that has a hidden URL that will perform an action against the authenticated site (via
img tags, for example). To prevent this, "real" URLs on the site require a token parameter to be passed with them, and this token is compared with a token stored on the session for validity. The assumption here is that the malicious site does not know the token.
What is stopping the malicious site from sending a GET request to the form-submission page and simply reading the token and modifying the hidden link?