5 ms·

Please use Access-Control-Max-Age instead. CORS has some nice security properties.

• jefftk 5y ago
  What is the security risk of moving from an API subdomain to a single host?
  • cerved 5y ago
    nothing CORS is just a verification that the cross domain request is to a trusted domain. Your own domain is assumed to be trusted, by default
    • jefftk 5y ago
      That is also my understanding, but I'm trying to find out what my parent thinks the security advantage is
  • zemnmez 5y ago
    CORS tries to prevent CSRF issues by preventing cross-origin cookie authentication.
    • jefftk 5y ago
      Sure, but moving your whole app under a single origin to avoid dealing with CORS doesn't weaken any protection here.
      • zemnmez 5y ago
        if handled correctly, sure. but it also means that implicit cookie authentication ('ambient authority') is possible and can easily happen by accident