DeepFrontend
Learning Paths
Practice
System Design & DS
Design Studio
Data Structures Curriculum
Real-World Case Studies
Careers
Job Board
Resume Builder
Blog
Sign in
Search
⌘K
Go Pro
Loading compiler resources...
Web Security Quiz Practice
Active Recall Drill Session
← Exit Session
Question 1 of 1
medium
Web Security
Why does CORS not protect against the classic form-based CSRF attack (an auto-submitting <form method="POST">)?
A
CORS actually does fully protect against this
B
A plain form submission never tries to READ the response via JavaScript, so the CORS read-restriction mechanism never comes into play at all — the request is simply sent and processed
C
Forms are always blocked regardless of CORS
D
CORS only applies to GET requests
Check Answer