3 ms·
What about CORS and CSP headers? Should public/open APIs use them and prevent building client side only apps?
by butz 3y ago
What about CORS and CSP headers? Should public/open APIs use them and prevent building client side only apps?
- gwbas1c 3y agoWhy would you want to block that?
- butz 3y agoI have stumbled upon several "open" APIs that had such "security measures" implemented, thus making them rather unusable. It would be a useful advice of what not to do, for anyone building public facing APIs.
- JimDabell 3y agoYou don’t use CORS to prevent client-side only apps, you use CORS to allow them. CORS reduces security restrictions, it doesn’t add them.