News for hackers. Stuff that matters.

A comment on CORS is not meant to secure an API endpoint. Parent comment

Re:CORS is not meant to secure an API endpoint by goto11 on Sunday February 13, 2022 @09:30AM (#30321936)
JavaScript in an uncompromized browser cannot send arbitrary headers. See: https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_...

Otherwise a malicious site could just forge the Origin header in the preflight request.

[ Parent | on HN ]
Re:CORS is not meant to secure an API endpoint by iancarroll on Sunday February 13, 2022 @09:44AM (#30322007)
This is true, but there have been a lot of browser bugs in the past with Origin/Referer headers. Relying on those is not as foolproof as a CSRF token, which would require a more severe UXSS-type issue to leak. I wouldn’t advise it.
[ Parent | on HN ]