News for hackers. Stuff that matters.

A comment on Looking at how many sites use vulnerable JavaScript libraries. Parent comment

Re:Looking at how many sites use vulnerable JavaScript libra... by oneweekwonder on Wednesday November 22, 2017 @03:47PM (#15760475)
But cors[0] headers can mitigate some of the risk?

[0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

[ Parent | on HN ]
Re:Looking at how many sites use vulnerable JavaScript libra... by amenghra on Wednesday November 22, 2017 @05:17PM (#15761177)
You want CSP headers to mitigate XSS risks.
[ Parent | on HN ]
Re:Looking at how many sites use vulnerable JavaScript libra... by thefreeman on Wednesday November 22, 2017 @04:51PM (#15761016)
Not really. CORS headers are set by the destination of the XHR. In the case of XSS it would be an attacker controlled server used to exfiltrate user cookies, etc.
[ Parent | on HN ]