3 ms·
The request does not send resource/cookie data if CORS does not explicitly relax the SOP. CORS does not protect!
by JanSt 5y ago
The request does not send resource/cookie data if CORS does not explicitly relax the SOP. CORS does not protect!
- goto11 5y agoA cross-origin POST request can be initiated using a HTML form and does send cookies. CORS provides a safer alternative.
- aobdev 5y agoCan you elaborate on how CORS provides an alternative? Responding with a CORS policy to your own client’s preflight requests is not going to do anything for a malicious client’s form POST.