title: Cross Domain Form POSTing
body: <p>I've seen articles and posts all over (including SO) on this topic, and the prevailing commentary is that same-origin policy prevents a form POST across domains.  The only place I've seen someone suggest that same-origin policy does not apply to form posts, <a href="http://blog.stevensanderson.com/2008/09/01/prevent-cross-site-request-forgery-csrf-using-aspnet-mvcs-antiforgerytoken-helper/" rel="noreferrer">is here</a>.</p>
  
  <p>I'd like to have an answer from a more "official" or formal source.  For example, does anyone know the RFC that addresses how same-origin does or does not affect a form POST?</p>
  
  <p><strong>clarification</strong>: I am not asking if a GET or POST can be constructed and sent to any domain.  I am asking:</p>
  
  <ol>
  <li>if Chrome, IE, or Firefox will allow content from domain 'Y' to send a POST to domain 'X'</li>
  <li>if the server receiving the POST will actually see any form values at all.  I say this because the majority of online discussion records testers saying the server received the post, but the form values were all empty / stripped out.</li>
  <li>What official document (i.e. RFC) explains what the expected behavior is (regardless of what the browsers have currently implemented).</li>
  </ol>
  
  <p>Incidentally, if same-origin does not affect form POSTs - then it makes it somewhat more obvious of why anti-forgery tokens are necessary.  I say "somewhat" because it seems too easy to believe that an attacker could simply issue an HTTP GET to retrieve a form containing the anti-forgery token, and then make an illicit POST which contains that same token.  Comments?</p>