4 ms·
SOP should primarily be understood as a restriction on reading responses, not making requests.
by feanaro 5y ago
SOP should primarily be understood as a restriction on reading responses, not making requests.
- SahAssar 5y agoSOP certainly does make restrictions on making requests, like setting any non-default headers (including content-type). It is one of the reasons that validating content-type to not be one of the normal form values used to be a valid way to handle CSRF for APIs.