Why do we have both CSRF protection and CORS?

Re:Why do we have both CSRF protection and CORS? by LudwigNagasena on Sunday March 02, 2025 @07:21PM (#43236842)

Also, nothing prevents you from checking the host server-side according to arbitrary logic and putting it into the CORS header dynamically.

[ Parent | on HN ]

Re:Why do we have both CSRF protection and CORS? by Retr0id on Monday March 03, 2025 @07:37AM (#43241166)

Nothing prevents this, but the client must still emit preflight checks (an extra round-trip) for every endpoint, and again if headers need to change.

[ Parent | on HN ]