Is it true that:
- Modern browsers add "origin" header to ANY cross-domain request.
- Modern browsers look for "Access-Control-Allow-Origin" header in response and do not process response body if there is no this header.
Hence server does not need use CSRF token to protect users with modern browsers. And server does not need CORS if cross-domain requests are undesirable.
In other words, are these statements true?
- modern browsers protect user data from XSS and no special actions required on server side if cross-domain requests are undesirable
- CORS on server side is required only if it is necessary to allow some trusted domains perform cross-domain requests
- CSRF token is required for old browsers only
