Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on Developers don't understand CORS (2019). Parent comment
Without the same origin policy CSRF protections would be trivial to circumvent, since you’d be able to read the CSRF token from any page.
Without the same origin policy CSRF protections would be trivial to circumvent, since you’d be able to read the CSRF token from any page.