[thepete2]

correction: same origin policy, so it doesn't work

[lol768]

SOP isn't relevant here - it relates generally to _reading_ content from another origin.

What is relevant here is whether the cookies are SameSite and/or whether a token is required.