Why do we have both CSRF protection and CORS?

Re:Why do we have both CSRF protection and CORS? by Muromec on Sunday March 02, 2025 @06:05PM (#43236237)

XHR is called xmlthttprequest for a reason, but that was added in 2000ies I think. SOAP was late 90ies, but I don't think you can call it from browser. There was no reason to have data in javascript before DOM and XHR which were late additions. All the stuff was in the page itself rendered by server and you don't get that across the domain boundary.

[ Parent | on HN ]

Re:Why do we have both CSRF protection and CORS? by thaumasiotes on Monday March 03, 2025 @12:53AM (#43238709)

> 2000ies

Now this is interesting. I've seen a lot of "40ties", "90ies", etc around, and I'm not sure why people do that. But once you've done it, it's clear how to read the text. Most of the non-numeric suffix is redundant; people mean "forties", not "forty-ties".

But "2000ies" has no potential redundancy and no plausible pronunciation. It's spelled as if you're supposed to pronounce it "two thousandies", but there's no such thing as a thousandy.

[ Parent | on HN ]

Re:Why do we have both CSRF protection and CORS? by alt227 on Monday March 03, 2025 @08:48AM (#43241661)

I enjoyed your analysis.

I think people should really just be putting 's on the end, then it works for all:

40's, 50's, 2000's.

The apostrophe is unecesary, but IMO without it it looks like the 's' is a standard unit of measurement:

40s, 50s, 2000s

[ Parent | on HN ]

Re:Why do we have both CSRF protection and CORS? by Muromec on Tuesday March 04, 2025 @11:32AM (#43256907)

twothousandies and twenty-zeroes makes sense

[ Parent | on HN ]