3 ms·
Wouldn't doing this on POST be dangerous? POSTs are not expected to be idempotent, so you're trusting the server to understand and check the Origin header etc.
by nly 11y ago
Wouldn't doing this on POST be dangerous? POSTs are not expected to be idempotent, so you're trusting the server to understand and check the Origin header etc.
- codedokode 11y agoYou can send POST to any server using a JS-submitted form so it doesn't introduce new attack vector.
- malft 11y agoYou get slightly more power in that you can post malformed multipart stuff.