If you don't have any data that needs to be shared only with some users, then none of this advice applies. But let's say you have https://social.example/moron4

If you don't have any data that needs to be shared only with some users, then none of this advice applies. But let's say you have https://social.example/moron4hire/photos/1234 https://social.example/moron4hire/photos/1234 which should only be visible to you and your contacts. If an attacker sends a manual HTTPS request, outside the browser, they won't have your credentials and so won't be able to view it -- good! Now let's say https://evil.example https://evil.example puts in <img src="https://social.example/moron4hire/photos/1234 https://social.example/moron4hire/photos/1234">. This succeeds, because the browser automatically sends credentials, but it wouldn't normally allow evil.example to read the image contents. Unfortunately, Spectre etc changes this: since the image is getting loaded into an address space controlled by JS from evil.com, the contents can probably be read. The recommendation is that if https://social.example/moron4hire/photos/1234 https://social.example/moron4hire/photos/1234 is (a) private and (b) only intended to be visible on https://social.example https://social.example, then it should be served with restrictive CORS headers.