Re:Why do we have both CSRF protection and CORS?
by JimDabell on Monday March 03, 2025 @12:13AM
(#43238513)
> > What stops a script on evil.com from going to bank.com...
> CORS
CORS does the exact opposite to what you think.
Those types of cross-site requests are forbidden by default by the Same-Origin Policy (SOP) and CORS is designed so you can allow those requests where they would otherwise be forbidden.
CORS is not a security barrier. Adding CORS removes a security barrier.
> CORS
CORS does the exact opposite to what you think.
Those types of cross-site requests are forbidden by default by the Same-Origin Policy (SOP) and CORS is designed so you can allow those requests where they would otherwise be forbidden.
CORS is not a security barrier. Adding CORS removes a security barrier.