3 ms·
All I have to do is put a proxy in front of your API and strip all your headers off and send responses anywhere I like. Given that, how can CORS be "security"?
by coolhand2120 6y ago
All I have to do is put a proxy in front of your API and strip all your headers off and send responses anywhere I like. Given that, how can CORS be "security"? It's totally insecure.
- dylz 6y agoThe point here is that if you put a proxy in front of your API, on your own infrastructure, _you are no longer in origin scope_ and cookies will not be sent along with the request.