News for hackers. Stuff that matters.

A comment on CORS is not meant to secure an API endpoint. Parent comment

Re:CORS is not meant to secure an API endpoint by hoppla on Sunday February 13, 2022 @06:26AM (#30320972)
Form Posts are limited to few content types, and application/json is not one of them. I have however found some CSRFs against POST endpoints that did not care that the request was text/plain
[ Parent | on HN ]

There are no comments on this comment yet.