3 ms·
> The premise of your article ... it's simply not true for single-origin sites But it is. Even if you consider your site single-origin "simple requests" includ
by kevincox 2y ago
> The premise of your article ... it's simply not true for single-origin sites
But it is. Even if you consider your site single-origin "simple requests" including form posts are allowed by default on some browsers. This requires some sort of solution. There are a handful of possible solutions, but something needs to be done.
Example solutions:
1. Use SameSite cookies.
2. Ensure that you don't respond dangerously to all simple requests.
3. Ignore credentials or block cross site requests.