News for hackers. Stuff that matters.

A comment on CORS is not meant to secure an API endpoint. Parent comment

Re:CORS is not meant to secure an API endpoint by JanSt on Sunday February 13, 2022 @05:09AM (#30320684)
The request does not send resource/cookie data if CORS does not explicitly relax the SOP. CORS does not protect!
[ Parent | on HN ]
Re:CORS is not meant to secure an API endpoint by goto11 on Sunday February 13, 2022 @08:26AM (#30321607)
A cross-origin POST request can be initiated using a HTML form and does send cookies. CORS provides a safer alternative.
[ Parent | on HN ]
Re:CORS is not meant to secure an API endpoint by aobdev on Sunday February 13, 2022 @12:01PM (#30323219)
Can you elaborate on how CORS provides an alternative? Responding with a CORS policy to your own client’s preflight requests is not going to do anything for a malicious client’s form POST.
[ Parent | on HN ]