Re:CORS is not meant to secure an API endpoint
by patrickthebold on Sunday February 13, 2022 @12:25PM
(#30323458)
I think the confusing is in "adding CORS". I think you mean "Adding CORS to the browser standards", and gp means "Adding some kind of CORS interceptor thing in my backend".
It's great that CORS is a thing in browsers, and you can use it if you need. But each person who uses it is allowing more origins, and so allows more requests.
Personally I always avoid CORS and just server every thing I need from the same origin, but that's just because of the kinds of things I've worked on.
It's great that CORS is a thing in browsers, and you can use it if you need. But each person who uses it is allowing more origins, and so allows more requests.
Personally I always avoid CORS and just server every thing I need from the same origin, but that's just because of the kinds of things I've worked on.