News for hackers. Stuff that matters.

A comment on Why do we have both CSRF protection and CORS?. Parent comment

Re:Why do we have both CSRF protection and CORS? by edoceo on Sunday March 02, 2025 @04:52PM (#43235580)
The point being, presumably, the page author explicitly chose to include a cross-domain script
[ Parent | on HN ]
Re:Why do we have both CSRF protection and CORS? by Muromec on Sunday March 02, 2025 @05:03PM (#43235683)
The script author however didn't. CORS is more about the remote giving consent to exfiltrate the data than it is about preventing injecting the data into it. You can always reject the data coming in
[ Parent | on HN ]