3 ms·
> There is basically no way to say to the browser - I am "X" and my friends are "Y" and "Z", they should have permissions to do things that I don't allow "A", "
by jameshart 5y ago
> There is basically no way to say to the browser - I am "X" and my friends are "Y" and "Z", they should have permissions to do things that I don't allow "A", "B", and "C" to do.
Isn't that CORS? That sounds like CORS.
- afiori 5y agoCORS can fully stop an origin from accessing an http resource, this discussion is about allowing different origin to reuse the browser local state (like cookies, http cache, local storage). CORS is a stronger security layer in the browse than cache segregation, some people want to keep the CORS security model but weaken cache segregation.