3 ms·
AFAIR it’s never the server that rejects the request in a CORS scenario: The server indicates what origins are allowed to call the API and the browser cancels t
by Xylakant 5y ago
AFAIR it’s never the server that rejects the request in a CORS scenario: The server indicates what origins are allowed to call the API and the browser cancels the request on behalf of the user if called on a website that’s not on the allowed list. The server canceling the request based on a header would be insecure since the client can send arbitrary headers.
- goto11 5y agoJavaScript in an uncompromized browser cannot send arbitrary headers. See: https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_... Otherwise a malicious site could just forge the Origin header in the preflight request.
- iancarroll 5y agoThis is true, but there have been a lot of browser bugs in the past with Origin/Referer headers. Relying on those is not as foolproof as a CSRF token, which would require a more severe UXSS-type issue to leak. I wouldn’t advise it.