What I know about CSRF is that a malicious website tricks a normal user into issuing a request to a trusted website using a form.
I understand that is possible because we can post forms to different domains. However, I see posts of Stackoverflow that say that one should also protect AJAX requests using a token.
Doesn't the Same-origin policy force an AJAX request to be issued only to the domain that the script was loaded from?
I have heard of Cross-origin resource sharing, but if my understanding is correct it needs the web server to enable it, so a normal server shouldn't allow such request.