3 ms·
Just to be clear: There's no need to "get around" CORS in the Zoom case. Browsers simply allow cross-domain GET and POST requests. Period. CORS mediates the ab
by mdavidn 7y ago
Just to be clear: There's no need to "get around" CORS in the Zoom case. Browsers simply allow cross-domain GET and POST requests. Period.
CORS mediates the ability of JavaScript running in one origin to _read_ responses from another origin. If Zoom wanted JavaScript on any site to read data from the local installation, their local web server would need only return appropriate CORS headers. This was not necessary for the use case of joining a meeting.
- jcheng 7y agoThis is my understanding too, but judging from the comments in this thread, either a lot of developers aren't clear on the difference between CORS and CSRF or else they're referring to aspects of CORS I'm not familiar with.
- alanfranz 7y agoIt is true. But then, it's an intentional bad design choice by whomever wrote the server. If your server does actions on a GET, or accepts POSTs without a CSRF token protection, that's not the fault of the browser, but a well known behaviour. CORS will solve the javascript/ajax part, BTW.