Ask HN: Has CORS Solved Anything?

Re:Ask HN: Has CORS Solved Anything? by coolhand2120 on Tuesday October 06, 2020 @05:56PM (#24702771)

All I have to do is put a proxy in front of your API and strip all your headers off and send responses anywhere I like. Given that, how can CORS be "security"? It's totally insecure.

[ Parent | on HN ]

Re:Ask HN: Has CORS Solved Anything? by dylz on Tuesday October 06, 2020 @07:01PM (#24703440)

The point here is that if you put a proxy in front of your API, on your own infrastructure, _you are no longer in origin scope_ and cookies will not be sent along with the request.

[ Parent | on HN ]