News for hackers. Stuff that matters.

A comment on Claude's API now supports CORS requests, enabling client-side applications. Parent comment

Re:Claude's API now supports CORS requests, enabling client-... by Thorrez on Friday August 23, 2024 @10:00AM (#41329091)
That attack you mention is a CSRF attack. CORS doesn't really protect against that. That exact attack you mention is possible if foo.test doesn't implement CSRF protection. CORS doesn't automatically provide CSRF protection.
[ Parent | on HN ]

There are no comments on this comment yet.