3 ms·
If the user decides to run a service on their intranet or localhost with a wide open CORS policy, isn't that their choice? Forgoing CORS and making all inter d
by oplav 6y ago
If the user decides to run a service on their intranet or localhost with a wide open CORS policy, isn't that their choice?
Forgoing CORS and making all inter domain requests user opt-in would make the web experience a lot worse, IMO. Making all intranet or localhost requests user opt-in seems less disruptive.
- souterrain 6y agoHowever, TCP sockets can't publish CORS policies. In the case of scanning, a CORS denial can still reveal information about the user's internal network, as a CORS denial is a different result than a network timeout or a TCP RST.