Re:Why do we have both CSRF protection and CORS?
by smagin on Sunday March 02, 2025 @05:44PM
(#43236053)
"search this site in google" shouldn't even be a POST request, but yeah, when we'll have better defaults for cookies it should work nicer. And if you are a web developer, you should check your session cookie attributes and explicitly set them to SameSite=Lax HttpOnly unless your frameworks does that already and unless you know what you're doing
[ Parent
| on HN ]
Re:Why do we have both CSRF protection and CORS?
by Muromec on Sunday March 02, 2025 @06:08PM
(#43236264)
It was GET request, but the point is -- you can make the request from the browser to a different domain by making a form. With JS and DOM you can make a hidden iframe and make the request without user initiating it or noticing even, but in both cases you don't get to read the result.