3 ms·
Well... CORS controls whether the browser lets the other page read the response, not issue the request, preflight not withstanding.
by euroclydon 7y ago
Well... CORS controls whether the browser lets the other page read the response, not issue the request, preflight not withstanding.
- tgsovlerkhgsel 7y agoYes, because issuing the request was already allowed despite the same-origin policy. For example, you can do GET requests with iframes, images or redirects, and POST requests with HTTP forms. The important part is that CORS can be used to relax any existing same-origin restrictions on HTTP requests. 1. If the same-origin policy isn't a problem for you, no need to change anything, obviously. 2. If you want to _tighten_ the same-origin policy, CORS isn't going to help you (as far as I know). 3. You can get rid of any request-related same-origin policy restriction with CORS, easily and in a way that is easy to secure. There is no need to build around it. 4. If you try to use something custom to achieve that instead, you're likely making a dumb mistake, because you're not only creating unnecessary work, but also most likely either breaking many more users than there are users that don't support CORS, or introducing a gaping security hole, or both. Usually both.