3 ms·
I am still so confused on why this vulnerability exists. For AJAX, you have CORS. Why was this even permitted for web-sockets ?
by lenkite 6y ago
I am still so confused on why this vulnerability exists. For AJAX, you have CORS. Why was this even permitted for web-sockets ?
- cygx 6y agoThis vulnerability predates websockets (in fact, you can exploit it even without Javascript) - they just make things more convenient. Apparently, the shit hit the fan a while ago, prompting Opera to implement 'cross network protection'[1], but other browser vendors did not follow suit. [1] https://web.archive.org/web/20121001002815/http://my.opera.com/securitygroup/blog/2012/07/03/operas-cross-network-protection https://web.archive.org/web/20121001002815/http://my.opera.c...