What is a CSRF token, and how does it differ from a CORS header?

A CSRF token is a unique, secret, and unpredictable value generated by the server and embedded in web forms to protect against Cross-Site Request Forgery attacks. It ensures that the request originated from the legitimate application, not an attacker's site. CORS (Cross-Origin Resource Sharing) headers, conversely, are HTTP headers used by servers to tell browsers whether to permit web applications running at one origin (domain) to access selected resources from a different origin. While both relate to web security, CSRF tokens prevent unauthorized state-changing requests, whereas CORS controls cross-origin data access. Bangalore hiring note: Companies like Razorpay and Flipkart frequently test this distinction for web security roles.