title: CSRF and iframes
body: <p>When preventing CSRF attacks I should take the following steps:</p>
  
  <ol>
  <li>User logs in, set session cookie and generate CSRF token</li>
  <li>User submits form (with token) and it should match the token in session</li>
  </ol>
  
  <p>But when an attacker uses an iframe it’ll also send the session cookie which results in the same CSRF token, also forms within the iframe will contain the token. So the attacker gets access.</p>
  
  <p>What am I missing here?</p>