7 ms·
Via the Origin header, just like the preflight requests use. The server is ultimately the one telling the browser what the rules are already. The reason a prefl
by johncolanduoni 8y ago
Via the Origin header, just like the preflight requests use. The server is ultimately the one telling the browser what the rules are already. The reason a preflight is needed is so that there is effectively a default deny policy, since both historically and even today you can’t assume all APIs that accept authentication tokens from the browser take into account any kind of cross origin access.
Even still, a lot of people just put ‘Access-Control-Allow-Origin: *’ on everything as soon as they run into an issue, so that rule has to ban credentialed requests altogether.
- sbergot 8y agoYou are talking about the Origin header set by the browser that you don't trust?
- johncolanduoni 8y agoThe whole point of CORS is that you trust the browser to do the preflight requests and obey them, otherwise it doesn’t do anything. If you have access to the credentials (which the browser does) and the ability to send whatever HTTP requests you want, you can bypass CORS entirely.