Cookie has the same origin policy, and different domain names cannot be accessed.
for example, there are two websites, AMague C, and website C is a malicious website. How does website C get the Cookie of website An and send a request to the server of website A?
the best way to prevent XSRF is to use CSRF-token.
< hr > cookie is generally used to save information. When you send a request to the same server, you will bring the cookie saved by the browser to that server , no matter which website you send the request from.
so the backend needs to set Access-Control-Allow-Origin . The browser will see whether your access to the website is a domain allowed, send a request and get the data if it is allowed, and send a request if it is not allowed, but the js script cannot get the returned data (you can still see the return in NetWork).
you can take a look at this article
.Previous: How to use the relatively simple (or the simplest) method to Filter an array?
Next: How can JS achieve the effect that the page cannot be switched, similar to the effect of routing?