What is a common mistake when working with cross-site request forgery CSRF?

A common mistake with cross-site request forgery CSRF is assuming CORS alone prevents CSRF is unsafe because browsers can send some cross-origin requests even when script code cannot read the response. The safer approach is to design and test the behavior explicitly rather than assuming the platform or dependency will handle it automatically.