3 ms·
Is it not the job of the server not the browser to configure cors?
by vorticalbox 7y ago
Is it not the job of the server not the browser to configure cors?
- outworlder 7y agoIt's a shared responsibility. The server has to publish the whitelist(in headers). The browser has to enforce it.
- vorticalbox 7y agoThat's what I thought, it's up to the server to define what is and isn't allowed, so servers on the local network need to set their cors correctly
- daxterspeed 7y agoIt is absolutely the job of the server to determine the source and validity of a request. Web browsers, for better or for worse, fundamentally allow websites to make requests to other sites. "Rogue" websites can "trick" users into requesting images, videos, music, javascript, stylesheets or trick users into making POST requests to your site. This is why tech like csrf tokens exist.
- penagwin 7y agoThe browser doesn't know by default what websites should be accessed. They don't know that l337haxor.dev doesn't have access to api.bank.com but bank.com does. Instead it's the server at api.bank.com 's responsibility to tell the browser it only accepts requests from bank.com.