Re:Developers don't understand CORS
by strictfp on Wednesday July 10, 2019 @06:02PM
(#20407065)
Wait. If the resource at bank.com is protected by a CORS filter, the request which is issued at step three will have an origin header, and the CORS implementation is free to issue a 401 at that point. At least as far as I have understood. That would be tightening the restrictions. Am I missing something?
[ Parent
| on HN ]
Re:Developers don't understand CORS
by tgsovlerkhgsel on Wednesday July 10, 2019 @08:00PM
(#20407852)
There used to be ways to get rid of the origin header, not sure if this is still the case. You can easily set it to "null", e.g. with some iframe trickery.