title: Can overly permissive CORS settings lead to CSRF?
body: <p>I feel like anytime I see documentation on CORS it's recommending to just have a default <code>Access-Control-Allow-Origin: *</code> configuration. It seems to me this is a perfect way to make your API now vulnerable to CSRF attacks. The explanation being that Same Origin Policy is the only thing stopping XHR requests in the browser from making API endpoints completely vulnerable to CSRF, and that CORS is essentially a bypass for SOP.</p>
  
  <p>Is my logic sound that any site with an overly permissive CORS settings is essentially exposing their backend API to CSRF attacks? If so, then this should be explicitly mentioned anytime CORS is brought up.</p>