3 ms·
> CORS is primarily focused on removing csrf (cross site request forgery) vulnerabilities basically CORS gives you zero defense against csrf. (ok, not zero, bu
by merb 5y ago
> CORS is primarily focused on removing csrf (cross site request forgery) vulnerabilities
basically CORS gives you zero defense against csrf. (ok, not zero, but also not much)
- horsawlarway 5y agoThis just isn't true. I don't consider request forgery to just be side-effect based (the classic example of a bank form post). I'm including any request that leaks data to a site based on cookies present only on the client (forged authenticated request). SOP/CORS was the foundation that allowed CSRF tokens to even work. (No SOP/CORS? Just request the form with the csrf token first, parse with js, append to next request) I guess you could say SOP is really the protecting force here, but CORS only exists because strict SOP broke a LOT of stuff. Enter trust zones in IE, and then CORS. SameSite now mostly tackles this by fixing the root issue with the cookie jar.
- merb 5y agocors never protected against csrf because you could just have a form that gets submitted via js. that worked for ALL post requests and it works in modern browsers as well and most csrf attackes used forms.