3 ms·
CORS is not a tool to turn resources private, but to protect the browser (not the server's content) from cross domain requests.
by felipelemos 8y ago
CORS is not a tool to turn resources private, but to protect the browser (not the server's content) from cross domain requests.
- scottydelta 8y agoExactly, the attacker can always not use the browser and emulate a browser request if motivated enough.
- throwawaymath 8y agoYes, that's precisely why CORS is a poor fit for authentication :)
- askmike 8y agoSure, but I don't see why the tip in OP is "don't use CORS". To me that implies there is actually something insecure about using it.
- throwawaymath 8y agoYeah you can use CORS securely, there are just pitfalls to look out for.