3 ms·

> It provides both opt-out protections as an attempt to mitigate XSS attacks nitpick, I guess, but CORS is about CSRF (Cross Site Request Forgery) and not XSS

> It provides both opt-out protections as an attempt to mitigate XSS attacks nitpick, I guess, but CORS is about CSRF (Cross Site Request Forgery) and not XSS (Cross Site Scripting). If you have an XSS bug, CORS can't save you since they can make requests from your origin.

simonw 2y ago
That's a pretty important nitpick. CSRF and XSS are very much not the same thing.
kevincox 2y ago
Sorry, you are completely correct. I'll update the article.