6 ms·

This also sneaks past CORS. I'm thinking _that's_ a problem.

• iancarroll 10y ago
  Why do you think this bypasses CORS?
  • imglorp 10y ago
    Well, it bypasses the spirit, which was to exert some control over what got loaded into the browser via the back door. Now, malicious code can just come in the front door.
    • RodgerTheGreat 10y ago
      If anything it's a useful demonstration of how CORS is more theater than security for anything beyond the most trivial scenarios.
      • moosingin3space 10y ago
        I wonder how hard it would be to come up with a "containerization" mechanism for the web so as to separate scripts/resources better.