title: Is using PHP Sessions safe with CSRF Protection?
body: <p>I have a script file called <code>get_user_unfo.php</code> that just returns a JSON file of the current logged-in user's data.</p>
  
  <p>When requested, the file first checks the CSRF token and then does a SQL search of the <code>users</code> table based on a session variable called <code>user_id</code>, which is set when the user logs in which is how it returns the JSON object.</p>
  
  <p>What would happen if someone from <code>evil.com</code> tried to request the PHP file from my wesbite using AJAX? </p>
  
  <blockquote>
    <p>A) Would nothing get returned because they're calling my file from a
    different website? If this is true and no results are returned then
    why is it advised to use long CSRF tokens? Surely just <code>1</code> or <code>0</code>
    would suffice?</p>
  </blockquote>
  
  <p>or... </p>
  
  <blockquote>
    <p>B) Would the request still be valid and would my website return other
    users information?</p>
  </blockquote>