4 ms·
Re 1: A CORS header should've blocked the use of <img> tags on domains cdn.fakercloud.com didn't want using them.
by JMTQp8lwXL 5y ago
Re 1: A CORS header should've blocked the use of <img> tags on domains cdn.fakercloud.com didn't want using them.
- ignoramous 5y ago> Re 1: A CORS header should've blocked the use of <img> tags on domains cdn.fakercloud.com didn't want using them. A limited defense. I've only ever seen browsers respect CORS.
- JMTQp8lwXL 5y agoExactly: Most modern browsers respect CORS. If you send response header "Access-Control-Allow-Origin: *", you're saying any origin can load the response. Clearly, the owner of cdn.fakercloud.com didn't want that behavior. The server can inspect the Origin header, and if the maintainer doesn't want to support the domain, then don't send the CORS Access-Control-Allow-Origin response header.