News for hackers. Stuff that matters.

A comment on Why do we have both CSRF protection and CORS?. Parent comment

Re:Why do we have both CSRF protection and CORS? by klysm on Monday March 03, 2025 @09:05AM (#43241831)
To make things even more complicated, service workers can intercept requests and change the request mode.
[ Parent | on HN ]
Re:Why do we have both CSRF protection and CORS? by smagin on Tuesday March 04, 2025 @03:44AM (#43252061)
oh god you're right https://stackoverflow.com/a/57206146/1685746 yeah sure what can go wrong, let's listen to fetch and modify requests in a service worker.
[ Parent | on HN ]
Re:Why do we have both CSRF protection and CORS? by klysm on Tuesday March 04, 2025 @02:10PM (#43258765)
I actually use this to add authentication headers to images directly via src="". No blob management in javascript :)
[ Parent | on HN ]