3 ms·
It's hosted on Github Pages which is just static file serving. And thanks to CORS restrictions I don't think you could phone home. Unless there's a workaround
by hbn 5y ago
It's hosted on Github Pages which is just static file serving. And thanks to CORS restrictions I don't think you could phone home.
Unless there's a workaround I'm not thinking of.
- heartbeats 5y agoCan't you embed off-site images?
- jamespwilliams 5y agoGitHub pages are served with Access-Control-Allow-Origin: *, so the SOP doesn’t apply. They also don’t set a CSP header, which opens up the opportunity to exfiltrate data by other means, e.g having the browser load an image on your.site/$password.jpg.
- hbn 5y agoAh right. Simple!
- Sohcahtoa82 5y agoThe CORS policy is set by the server receiving the request, not the page/server sending it.