In general, a browser sends all the cookies it has for site A whenever it makes a request to site A.
It doesn't usually matter where the request originated. There are two cases where it does, though:
fetch) will send cookies by default for same-origin requests, but not by default for cross-origin requests. You can specify that you want them sent for cross-origin, though.
- The new
samesite flag on cookies will restrict situations where they are sent via cross-origin requests. However, not all browsers support it yet, there are cases where it will break things, and unless in "strict" mode it will still send cookies on top-level navigation (such as when a link is clicked or
window.location.href is set), which could exploit sites vulnerable to GET-based CSRF.
It also can matter whether you're sending the request over HTTP or HTTPS - cookies with the Secure flag will only go over HTTPS - but in general anything on a secure site should require HTTPS anyhow so that's where the attacker would direct their CSRF attack.
In other words:
Does that call also carry the cookies stored in the browser for site A or is it that cookies are only sent through the appropriate domain context?
Yes, every call to request A will have the cookies for site A, regardless of where the request is coming from (aside from the caveats above).