4 ms·
Is it fair to say that the strongest CORS request allows the weakest? That is, if your server supports a preflighted, credentialed, cached CORS request with wei
by Steltek 5y ago
Is it fair to say that the strongest CORS request allows the weakest? That is, if your server supports a preflighted, credentialed, cached CORS request with weird headers and methods, then it would support just about anything?
Perhaps a detailed walkthrough of that one specific scenario, which would enable almost all others, would be helpful.
- jaffathecake 5y agoYeah, the most permissive CORS allows everything, although it's kinda risky to do if you don't understand the consequences.
- ufmace 5y agoI don't think that's very accurate generally - the CORS Access-Control headers are pretty flexible, and can be locked down to only allow the specific weird thing you want to do. The part where that is kind of true is setting cookies with SameSite=None - it's needed for the CORS credentials to work, but it might cause security issues with other uses of your website.