4 ms·
It's an interesting feature, but remember that CORS exists for a reason; this can also lead to a delightful variety of custom CSRF attacks etc. ;)
by gunapologist99 3y ago
It's an interesting feature, but remember that CORS exists for a reason; this can also lead to a delightful variety of custom CSRF attacks etc. ;)
- simonw 3y agoCan it though? I've been trying to figure out some security problems that are a result of this CORS policy - as I'm considering it for my own application - and I can't figure out how an attack could actually work. The API I'm working with uses Authorization: Bearer tokens, and only allows incoming requests with a valid API token.