3 ms·
It's a shared responsibility. The server has to publish the whitelist(in headers). The browser has to enforce it.
by outworlder 7y ago
It's a shared responsibility. The server has to publish the whitelist(in headers). The browser has to enforce it.
- vorticalbox 7y agoThat's what I thought, it's up to the server to define what is and isn't allowed, so servers on the local network need to set their cors correctly