Re:Why does Google append while(1); in front of their JSON r...
by mmahemoff on Tuesday February 05, 2013 @09:14AM
(#5170696)
Actually as yoghur points out, CORS doesn't protect against CSRF. A token must be passed for any privileged calls.
That said, a benefit of CORS is the ability to do non-GET methods. So it's safer in the sense of HTTP idempotence, ie you can change server state safely, using POSTs, DELETEs, and so on. You'd still need to pass a token, however.
(Of course I meant cross-domain, not cross-browser :).
That said, a benefit of CORS is the ability to do non-GET methods. So it's safer in the sense of HTTP idempotence, ie you can change server state safely, using POSTs, DELETEs, and so on. You'd still need to pass a token, however.
(Of course I meant cross-domain, not cross-browser :).