title: CSRF, javascript and jquery
body: <p>Is it possible for a CSRF attack to read the contents of global JavaScript variables already present on the victim's browser?  </p>
  
  <p>My plan is to have the application store a CSRFToken value that is stored in the session when the user successfully logs on, and then I save that in a globally accessible JavaScript variable for use in the application.  I will use jQuery to automatically append this value to any form post action within the application. On the server side I will check to see if the values match and either complete the action or block it if no match is found.</p>
  
  <p>My understanding is that a CSRF attack can be deployed by a variety of methods, but they all need to re-direct the victim to a 3rd party site to execute malicious code.  The 3rd party site can try to forge a form request for example, but unless they know the contents of the CSRFToken, the action will fail.   Unless of course.. they can get to it somehow.  Is this possible? </p>