3 ms·
The people with the security problem are the users of browsers, and the browser vendors have a solution to solve that problem built into the browser. If they di
by mattnewton 8y ago
The people with the security problem are the users of browsers, and the browser vendors have a solution to solve that problem built into the browser. If they didn’t enforce it at the browser level, the owners of the servers would have little incentive to enforce CORS and most just wouldn’t. See https adoption.
- johncolanduoni 8y agoBingo. I still kind of wish there was an ability to make the browser invoke some kind of request that servers would reject by default (e.g. with a non-standard HTTP method) that could combine the preflight check and the request while still making servers that don’t anticipate CORS blanch and not take any dangerous actions. But the browser security model is complex and messy enough as it is, so I doubt it’s worth it.
- paulddraper 8y ago> the owners of the servers would have little incentive to enforce CORS and most just wouldn’t Huh? They already implement authorization. (Transport security is similar but different.) And I've seen plenty of Allow-Origin-Access-Control: * because people get frustrated with CORS, e.g. they can't allow access for *. example.org.