4 ms·
If it's got CORS enabled you can do a hell of a lot more than ping your server.
by echeese 7y ago
If it's got CORS enabled you can do a hell of a lot more than ping your server.
- maratd 7y agoWait, what? I think you means the opposite. If it's got CORS enabled, then you can't do anything unless the request is originating from the relevant domain. Anyway, do not rely on firewalls (and CORS is a firewall) as the sole security measure. Do not create unauthenticated endpoints unless you want everybody to use them.
- echeese 7y agoTo elaborate, I meant a permissive CORS policy, which is what I see most often.