4 ms·
Is there any reason to keep the Same Origin Policy after this change? I mean, shouldn't this change defeat CSRF attacks?
by arendtio 6y ago
Is there any reason to keep the Same Origin Policy after this change? I mean, shouldn't this change defeat CSRF attacks?
- aembleton 6y agoNo, this won't defeat CSRF attacks. All this does is create a separate cache for each site, so that they can't infer that a user has already been to another site. It makes no changes to POST/PUT/PATCH requests to an endpoint. They will still be going there.
- arendtio 6y agoOkay, I thought it would also keep the browser from sending cookies/authentication data, it received via another origin.