title: Why is a csrf token needed when a session cookie is used?
body: <p>Say I login through an opendID connect provider and am redirected to my callback <code>www.mysite.com/auth/callback</code>. I then create an httponly cookie, which contains an id referencing to my received tokens, that is passed to the browser at <code>wwww.mysite.com/</code>. How would another site submit a request that contains that same session cookie? Does the browser not pass only the cookies of the requesting domain. So if <code>www.evil.com</code> tries to make a request to <code>www.mysite.com/api/endpoint</code>, won't the session cookie not be passed, making the forged request invalid? </p>
  
  <p>Am I missing something basic here??</p>