title: CSRF Protection with tokens in meta tag - why can't it be stolen?
body: <p>A recommendation for being able to include a csrf prevention token in ajax calls is to include them as a meta tag in your page, which can then be accessed and included in the header.
  <a href="http://docs.spring.io/spring-security/site/docs/3.2.0.CI-SNAPSHOT/reference/html/csrf.html" rel="nofollow">http://docs.spring.io/spring-security/site/docs/3.2.0.CI-SNAPSHOT/reference/html/csrf.html</a></p>
  
  <p>How is this not exploitable? For example if example.com included the csrf token in a meta tag, could I not just create a malicious site that has some javascript that will make a call to example.com, and then parse the response, find the meta tag, and then inject the token value into my malicious page form?</p>