Re:Why do we have both CSRF protection and CORS?
by chuckadams on Sunday March 02, 2025 @07:01PM
(#43236698)
Ah yes, good catch. That's what the `state` parameter is about, right? But I'll weasel out and say that lack of a content type (being a GET) is one of the built-in types too ;)
[ Parent
| on HN ]
Re:Why do we have both CSRF protection and CORS?
by jcmfernandes on Monday March 03, 2025 @04:04AM
(#43239832)
That is correct :)