3 ms·
If an HTTP API is GET request only and there is no authentication for the API, think public weather info API, is there any risks with having "Access-Control-All
by DrOctagon 7y ago
If an HTTP API is GET request only and there is no authentication for the API, think public weather info API, is there any risks with having "Access-Control-Allow-Origin: *" set?
I've tried to get my head around CORS a few times without much luck.
- syntheticcdo 7y agoACAO:* is appropriate for a publicly accessible, unauthenticated request.