title: How is using Synchronizer Token Pattern to prevent CSRF safe?
body: <p>I have been reading about using a synchronizer token pattern to prevent CSRF (CSRF meaning Cross-site request forgery.), and I don't understand how it actually safe.</p>
  
  <p>Let's say I have a fake bank site fakebank.com with two urls:</p>
  
  <ul>
  <li><code>fakebank.com/withdrawForm.html</code> - a GET request which displays the withdraw money form</li>
  <li><code>fakebank.com/doWithdraw</code> - POST to this url to do the withdraw</li>
  </ul>
  
  <p>My understanding of the security flaw is that <code>maliciousSite.com</code> can spoof a POST request to <code>fakebank.com/doWithdraw</code>, and if you're currently logged in to fakebank, the POST will be successful.</p>
  
  <p>Let's say we implement a Synchronizer Token Pattern which will embed a secret code on <code>fakebank.com/withdrawForm.html</code>. Can't <code>maliciousSite.com</code> just spoof a GET request for that form, parse the html result, get the token, and then create the POST request with that token?</p>
  
  <p>This is assuming fakebank.com isn't checking HTTP Referrer or Origin or <code>maliciousSite.com</code> is successfully spoofing that the Referrer/Origin is fakebank.com.</p>