News for hackers. Stuff that matters.

A comment on Polyfill supply chain attack hits 100K+ sites. Parent comment

Re:Polyfill supply chain attack hits 100K+ sites by bawolff on Wednesday June 26, 2024 @02:37PM (#40803076)
CORS is not required to run third party scripts. Cors is about reading data from third parties not executing scripts from third parties.

(Unless you set a Cross-Origin Resource Policy header, but that is fairly obscure)

[ Parent | on HN ]

There are no comments on this comment yet.