News for hackers. Stuff that matters.

A comment on Developers don't understand CORS. Parent comment

Re:Developers don't understand CORS by superasn on Wednesday July 10, 2019 @05:09PM (#20406575)
Yes also see my comment about csrf token too. If the request changes user data it must be a POST request with csrf protection.

You can't make POST requests with ajax as CORS will protect you, but evil.com can create a fake form submission (with bank.com/transfer.php as the form's action) which can be a POST request. So in this case you match the csrf token which only you know and which is unique for the form/session.

It's a rabbithole :)

[ Parent | on HN ]
Re:Developers don't understand CORS by greenshackle2 on Wednesday July 10, 2019 @05:29PM (#20406764)
It seems you can make a POST request from javascript, as long as it doesn't have non-standard headers or content-type.

Try it yourself: https://news.ycombinator.com/item?id=20406633

[ Parent | on HN ]