News for hackers. Stuff that matters.

A comment on Why do we have both CSRF protection and CORS?. Parent comment

Re:Why do we have both CSRF protection and CORS? by smagin on Monday March 03, 2025 @07:20AM (#43241056)
Why would you need that?

Also, one thing I can speculate that phishing would become even easier if such things were allowed

[ Parent | on HN ]
Re:Why do we have both CSRF protection and CORS? by yoavm on Monday March 03, 2025 @11:25AM (#43243360)
Because defaulting to NOT allowing cross-origin requests made it so that being lazy creates a more closed web. And people are lazy.
[ Parent | on HN ]