Re:CORS is not meant to secure an API endpoint
by mmis1000 on Sunday February 13, 2022 @11:26AM
(#30322843)
> Really CORS cannot be used to lock anything down.
yep, that's what Cross-Origin Resource Policy (CORP) for.
It is designed to seal the last loop hole in same-origin policy. (img and scripts don't require cors at all)
But there is a big gotcha, the old browser that don't know about it simply don't care. So it isn't strictly useful for now.
yep, that's what Cross-Origin Resource Policy (CORP) for. It is designed to seal the last loop hole in same-origin policy. (img and scripts don't require cors at all) But there is a big gotcha, the old browser that don't know about it simply don't care. So it isn't strictly useful for now.