5 ms·
> But if the bad guy really needs their script to get data from C, they could just go through an intermediate server they control that relays data from C. Your
by jvns 6y ago
> But if the bad guy really needs their script to get data from C, they could just go through an intermediate server they control that relays data from C.
Your browser has access to 2 things that the malicious actor's server doesn't:
1. your cookies (which it will normally send with any HTTP requests it makes)
2. your network position (for example if you're on a private corporate network and have access to some internal corporate servers)
- saurik 6y agoFWIW, #1 is both easily fixed and AFAIK mostly already fixed (making cookies additionally scoped by origin of the requesting page, preventing "third-party cookies"). To the extent to which it isn't fixed, it should be fixed at that level.