Re:CORS is not meant to secure an API endpoint
by JanSt on Sunday February 13, 2022 @06:28AM
(#30320983)
Apart from the misunderstanding that CORS protects you, you are describing two scenarios.
I don't really understand the first one or why you think SOP should protect you in that case. Could you restate that problem?
The second one is a CSRF issue, as noted by another user.
The third thing you describe is not people who disable CORS but actually use CORS to the max (usally things like Access-Control-Allow-Origin: *), because they don't understand what it does. It's a huge problem...
I don't really understand the first one or why you think SOP should protect you in that case. Could you restate that problem?
The second one is a CSRF issue, as noted by another user.
The third thing you describe is not people who disable CORS but actually use CORS to the max (usally things like Access-Control-Allow-Origin: *), because they don't understand what it does. It's a huge problem...