News for hackers. Stuff that matters.

A comment on Why do we have both CSRF protection and CORS?. Parent comment

Re:Why do we have both CSRF protection and CORS? by PantaloonFlames on Sunday March 02, 2025 @01:45PM (#43233588)
I don’t have a Time Machine or a 1998-era browser but I’m not sure what you described was the case. I think in the before times, a browser could send a request to any arbitrary endpoint that was not the page origin, and it could also see the response. I might be wrong.

But anyway, ancient history.

[ Parent | on HN ]
Re:Why do we have both CSRF protection and CORS? by fweimer on Sunday March 02, 2025 @03:23PM (#43234636)
Wikipedia references this part of the Netscape Navigator documentation: https://web.archive.org/web/20020808153106/http://wp.netscap...

This suggests that the same-origin policy was introduced rather quickly after the introduction of Javascript, as a security fix.

[ Parent | on HN ]