3 ms·
In that case, the attacker's endpoint will be on a different domain than your endpoint, so the cookie from your domain won't be included in the request.
by TheCoelacanth 5y ago
In that case, the attacker's endpoint will be on a different domain than your endpoint, so the cookie from your domain won't be included in the request.
- icedchai 5y agoThat is true! But if they find some other vuln that gets them the cookie perhaps the proxy could still be of use.
- TheCoelacanth 5y agoWell, yes, hypothetical vulnerabilities can break any form of security, but without the same-origin policy, they don't even need another vulnerability.