3 ms·

I agree - I'm not really sure what the parent poster is on about. CORS and SRI are orthogonal, and designed to solve entirely different problems. CORS is prim

• merb 5y ago
  > CORS is primarily focused on removing csrf (cross site request forgery) vulnerabilities basically CORS gives you zero defense against csrf. (ok, not zero, but also not much)
  • horsawlarway 5y ago
    This just isn't true. I don't consider request forgery to just be side-effect based (the classic example of a bank form post). I'm including any request that leaks data to a site based on cookies present only on the client (forged authenticated request). SOP/CORS was the foundation that allowed CSRF tokens to even work. (No SOP/CORS? Just request the form with the csrf token first, parse with js, append to next request) I guess you could say SOP is really the protecting force here, but CORS only exists because strict SOP broke a LOT of stuff. Enter trust zones in IE, and then CORS. SameSite now mostly tackles this by fixing the root issue with the cookie jar.
    • merb 5y ago
      cors never protected against csrf because you could just have a form that gets submitted via js. that worked for ALL post requests and it works in modern browsers as well and most csrf attackes used forms.