2 ms·
CORS protects users, not services, so it's entirely reasonable that the evaluation of policy occurs in the user agent.
by inopinatus 8y ago
CORS protects users, not services, so it's entirely reasonable that the evaluation of policy occurs in the user agent.
- bzbarsky 8y agoActually, CORS protects both. If CORS aimed to only protect users, there would be no need for a preflight at all. The only reason preflights exist is to protect services from receiving requests they might really not expect (e.g. malformed data) and doing bad things as a result. In particular, the idea is to protect non-publicly-routable services. Publicly-routable ones, where you can just issue an attack request with cURL or the like, have to be hardened against malformed requests to start with. But there are tons of non-publicly-routable things (think printers and the like behind firewalls) that could be attacked via browsers that are running behind the firewall loading web pages from outside the firewall. And CORS aims to mitigate or prevent some of those attacks.