1) User is logged in bank.com in one tab, where everything is secured by CSRF tokens. Then he opens evil.com in another tab.
2) Javascript in evil.com might try to make a POST request to bank.com/send_money only if it knew csrf_token.
3) In order to reveal csrf_token, javascript in evil.com might try to do GET ajax call to bank.com/send_money to get the exact same html user would get by visting this page in his browser. And then read the token.
QUESTION - why the last step will fail and will it always fail?
As far as I understand, bank.com will actually respond to this request and render all the html just fine, but on the client side the browser will decide that content coming from another domain should not be accessible, therefore it fails.
If there is an iframe in evil.com to bank.com/send_money, the iframe will load all the html just fine, but again the browser will decide that this html cannot be used by javascript and it can only be viewed in iframe. Therefore JS cannot get the token and cannot make POST request.
Is it correct? Can this be fooled?