3 ms·
>- I pledge to only make GET requests to http://example.com/foo/ http://example.com/foo/* Doesn't solve any trust issue since data can be send as part of the
by gwervc 2y ago
>- I pledge to only make GET requests to http://example.com/foo/ http://example.com/foo/*
Doesn't solve any trust issue since data can be send as part of the URL, and the backend response can change at will.
- Timon3 2y agoThat was just an example - it fully solves trust issues if the pledge is "only make GET requests to exactly example.com/favicon.ico or example.com/style.css". This way you can't send any data (as there's no body, and encoded data wouldn't match the URLs).