4 ms·
> Remove cookies and basic auth headers, what's the point of CORS? The ability to communicate with a domain other than the one your app is running on. For inst
by untog 7y ago
> Remove cookies and basic auth headers, what's the point of CORS?
The ability to communicate with a domain other than the one your app is running on. For instance, if my site on www.example.com wants to send a POST to www.example2.com, I need CORS. example2.com needs CORS to specify that only example.com is allowed to send a POST to it, not anyoldaddress.com. example2.com could look at the Origin header and refuse connections, but it would be vulnerable to DDOS attacks.
Now, if your SPA is entirely self-contained and self-hosted then no, you don't need CORS. But there are plenty of situations where that isn't the case.
- disiplus 7y agoyup, i have a signup form on our website and that signup form calls ajax if the email is in use. without cors i would have to use jsonp or some other workaround.
- throwamay1241 7y agoI don't think the act of sending the POST is blocked by CORS, receiving the POSTed response data is though.