4 ms·
According to the page the HTTP CORS headers prevent JS execution. But the problem remains that svg can embed and execute JS on servers without these non-default
by tlhunter 3y ago
According to the page the HTTP CORS headers prevent JS execution. But the problem remains that svg can embed and execute JS on servers without these non-default headers.
- lol768 3y agoCSP, not CORS. CORS is for allowing other origins to read resources (and send special requests/special headers). It's not really relevant here.