3 ms·
But cors[0] headers can mitigate some of the risk? [0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS https://developer.mozilla.org/en-US/docs/Web/HTT
by oneweekwonder 9y ago
But cors[0] headers can mitigate some of the risk?
[0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
- thefreeman 9y agoNot really. CORS headers are set by the destination of the XHR. In the case of XSS it would be an attacker controlled server used to exfiltrate user cookies, etc.
- amenghra 9y agoYou want CSP headers to mitigate XSS risks.