News for hackers. Stuff that matters.

A comment on Why Static Websites Need HTTPS. Parent comment

Re:Why Static Websites Need HTTPS by austincheney on Tuesday August 28, 2018 @03:32PM (#17862106)
CORS allows a site to bypass same origin policy according to a whitelist specified in the corresponding HTTP header. The setup on evil.com is irrelevant. CORS must be instantiated from the server sending the page.

https://en.wikipedia.org/wiki/Cross-origin_resource_sharing

[ Parent | on HN ]
Re:Why Static Websites Need HTTPS by icebraining on Tuesday August 28, 2018 @07:01PM (#17863686)
No. From your link: "Note that in the CORS architecture, the ACAO header is being set by the external web service (service.example.com), not the original web application server (www.example.com). CORS allows the external web service to authorise the web application to use its services and does not control external services accessed by the web application."
[ Parent | on HN ]