5 ms·

What is the security risk of moving from an API subdomain to a single host?

• cerved 5y ago
  nothing CORS is just a verification that the cross domain request is to a trusted domain. Your own domain is assumed to be trusted, by default
  • jefftk 5y ago
    That is also my understanding, but I'm trying to find out what my parent thinks the security advantage is
• zemnmez 5y ago
  CORS tries to prevent CSRF issues by preventing cross-origin cookie authentication.
  • jefftk 5y ago
    Sure, but moving your whole app under a single origin to avoid dealing with CORS doesn't weaken any protection here.
    • zemnmez 5y ago
      if handled correctly, sure. but it also means that implicit cookie authentication ('ambient authority') is possible and can easily happen by accident