2 ms·
Would relying on CORS still work as long as the server checks that the type is actually application/json? Since those headers are impossible to set from a form,
by matsemann 5y ago
Would relying on CORS still work as long as the server checks that the type is actually application/json? Since those headers are impossible to set from a form, and doing it with fetch it would trigger a preflight request.
- amenghra 5y agoHistorically, it would have been weak since Java/Flash gave you more control over sockets than what’s available with js. In today’s world, it might be ok. I would personally build defense in depth and not just rely on one weak property.