4 ms·
Even this article gets it wrong: CORS does not protect you in any way. It‘s a relaxation of the SOP! Thus it decreases security.
by JanSt 5y ago
Even this article gets it wrong: CORS does not protect you in any way. It‘s a relaxation of the SOP! Thus it decreases security.
- chrismorgan 5y ago(SOP = same origin policy: https://en.wikipedia.org/wiki/Same-origin_policy https://en.wikipedia.org/wiki/Same-origin_policy.)
- tshaddox 5y agoThat’s oversimplified to the point of being extremely misleading. Under SOP, the way you loaded third-party data (not code) was JSONP, where (oops!) you’re actually loading third-party code but you just cross your fingers and hope the third party doesn’t deliver you any nefarious code.
- JanSt 5y agoCORS does allow to share, not disallow! The default under SOP is not to share.
- TheCoelacanth 5y agoYou're ignoring their point. There are still ways to share across origins even with SOP and without CORS, for example JSONP[1]. Using CORS is more secure than the pre-CORS way of sharing things across domains. [1] https://en.wikipedia.org/wiki/JSONP https://en.wikipedia.org/wiki/JSONP