4 ms·
I can't make this work on my side, both Chromium and Firefox block the requests for the font resources from l0.cm (because CORS policy): Font from origin '
by gorhill 11y ago
I can't make this work on my side, both Chromium and Firefox block the requests for the font resources from l0.cm (because CORS policy):
Font from origin 'http://l0.cm' has been blocked from loading by Cross-Origin Resource Sharing policy:
No 'Access-Control-Allow-Origin' header is present on the requested resource.
Origin 'http://lepunk.co.uk' is therefore not allowed access.
- lepunk 11y agoi think thats just a matter of adding this header on the server side Access-Control-Allow-Origin:
- Buge 11y agoThat warning just stops the font from being visible to the victim. I'm pretty sure the requests still go to the attacker.
- gorhill 11y ago> I'm pretty sure the requests still go to the attacker You are right, they do, it's just that the returned data is not allowed to be seen/used by the page -- the "l0.cm" server still got the information.