News for hackers. Stuff that matters.

A comment on A proposal to restrict sites from accessing a users' local network. Parent comment

Re:A proposal to restrict sites from accessing a users' loca... by afiori on Thursday June 05, 2025 @11:49AM (#44192836)
A WebSocket starts as a normal http request, so it is subject to cors if the initial request was (eg if it was a post)
[ Parent | on HN ]
Re:A proposal to restrict sites from accessing a users' loca... by odo1242 on Thursday June 05, 2025 @12:25PM (#44193168)
Unfortunately, the initial WebSocket HTTP request is defined to always be a GET request.
[ Parent | on HN ]
Re:A proposal to restrict sites from accessing a users' loca... by hnav on Thursday June 05, 2025 @01:23PM (#44193756)
websockets aren't subject to CORS, they send the initiating webpage in the Origin header but the server has to decide whether that's allowed.
[ Parent | on HN ]