3 ms·
> don't set Access-Control-Allow-Origin (or only set it to a star) Huh? These are two _very_ different situations. Not setting `Access-Control-Allow-Origin` wo
by Ajedi32 9y ago
> don't set Access-Control-Allow-Origin (or only set it to a star)
Huh? These are two _very_ different situations. Not setting `Access-Control-Allow-Origin` would mean that no third party site can read data from your domain. Setting it to `*` would do the exact opposite, allowing any site to read data on the page.
It's also unclear to me how this relates to Spectre and Meltdown.
- espadrine 9y agoThe Site Isolation page[0] states: > This protection is made possible by the following changes in Chrome's behavior: > […] > - Cross-site "documents" (specifically HTML, XML, and JSON files) are not delivered to a web page's process unless the server says it should be allowed (using CORS). I understand it to mean that the tab's process used to hold code that verified the CORS header, and that the verification is now out-of-process. [0]: http://www.chromium.org/Home/chromium-security/site-isolation http://www.chromium.org/Home/chromium-security/site-isolatio...