Cross-Site Request Forgery
CSRF occurs when a malicious site causes a victim's browser to send an authenticated request to another site, relying on automatically attached credentials such as cookies.
Cookie-authenticated APIs therefore require CSRF considerations. Defenses include SameSite cookies, CSRF tokens, origin checks, and appropriate architectural choices.
Bearer tokens manually attached by JavaScript are not automatically included by the browser in the same way as cookies, but storing tokens in browser-accessible storage introduces other risks such as token theft through XSS.
CORS Does Not Prevent CSRF
CORS controls whether browser scripts can read cross-origin responses. CSRF concerns unauthorized state-changing requests made with automatically attached credentials.