What are the differences between CSRF and CORS?

CSRF is a vulnerability and CORS is a method to relax the same-origin policy. CORS is something you might want to use (in certain circumstances) whereas CSRF is an undesirable design mistake.

There are vulnerabilities associated with the CORS mechanism. For example you might accidentally allow all websites to include scripts (wildcard *) which would enable all sorts of nasty things that resemble CSRF attacks but also other attacks such as stealing information (incl. CSRF tokens) and create injections that perform like XSS or even harness the resources of the poorly configured service. It all depends on the application and the exploit. But poorly configured CORS certainly enables CSRF in certain cases where it would not be possible otherwise.

Sometimes CORS is also associated with the protection methods of how to prevent CSRF attacks. The most typical way to mitigate the attack is to use anti-CSRF tokens but it is also possible to prevent the attack by checking the Origin: or Referer: header which is related to CORS. But it is useful to notice that this is more complicated than it sounds and it is not a good idea to assume that good CORS rules will prevent all CSRF attacks.

Access-Control-Allow-Origin which is generally called CORS(Cross-Origin Resources Sharing) opens doors for other specific domain who wants to request specific content. (Access-Control-Allow-Origin等价于CORS)

从站点a去请求站点b的时候，就是跨站点请求，浏览器会禁止跨域请求，报下面的错:
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://xxx/.
解决方法: 服务器设置Access-Control-Allow-Origin: *

1. CSRF 是一种容易被黑客攻击的漏洞，CORS是一种relax同源策略的手段（也就是允许部分不同源的网站访问你的API）。
2. CORS的使用可能导致CSRF。
3. 有时候也使用CORS相关的概念来防止CSRF。例如使用检查Origin和Referer 这个两个header是否一致，或者是否存在，来防止CSRF。而Origin和Referer是CORS相关的。
   我们的产品中就自己实现了CSRFStrictFilter来防止CSRF。主要做了下面的三个检查:
   • check if the http request is CSRF safe
     
   • 1. if it is strict CSRF checking, Referer attribute in HTTP request header can not be null
        
   • 2. Host attribute in HTTP request header can not be null
        
   • 3. Host and Referer should match, i.e., from the same origin
        
   • Client will be redirected to /zosmf/errorPage.jsp with the exception code if CSRF checking failed.

https://www.quora.com/What-are-the-differences-between-CSRF-and-CORS