3 ms·
You are talking about the Origin header set by the browser that you don't trust?
by sbergot 8y ago
You are talking about the Origin header set by the browser that you don't trust?
- johncolanduoni 8y agoThe whole point of CORS is that you trust the browser to do the preflight requests and obey them, otherwise it doesn’t do anything. If you have access to the credentials (which the browser does) and the ability to send whatever HTTP requests you want, you can bypass CORS entirely.