3 ms·
Surely you can implement your security rules this way. But for most people CORS are a cheaper way to enable cross origin requests. And clueless people are stuck
by sbergot 8y ago
Surely you can implement your security rules this way. But for most people CORS are a cheaper way to enable cross origin requests. And clueless people are stuck with same origin policy which secure by default.
- paulddraper 8y ago> CORS are a cheaper way to enable cross origin requests Is it really that much more expensive to check the Origin header than to check the Authorization and Cookie headers?
- ec109685 8y agoIf your server can handle Origin checks that way, then leave your CORS headers wide open and problem solved. The problem is that existing servers don’t generally check origin headers, so browsers needed some other mechansim to understand which requests were safe.