3 ms·
That’s oversimplified to the point of being extremely misleading. Under SOP, the way you loaded third-party data (not code) was JSONP, where (oops!) you’re actu
by tshaddox 5y ago
That’s oversimplified to the point of being extremely misleading. Under SOP, the way you loaded third-party data (not code) was JSONP, where (oops!) you’re actually loading third-party code but you just cross your fingers and hope the third party doesn’t deliver you any nefarious code.
- JanSt 5y agoCORS does allow to share, not disallow! The default under SOP is not to share.
- TheCoelacanth 5y agoYou're ignoring their point. There are still ways to share across origins even with SOP and without CORS, for example JSONP[1]. Using CORS is more secure than the pre-CORS way of sharing things across domains. [1] https://en.wikipedia.org/wiki/JSONP https://en.wikipedia.org/wiki/JSONP