3 ms·
sounds weird to me too, although I guess there could be a script that was not allowed to do CORS that then instead created an inline script and did its CORS stu
by bryanrasmussen 2y ago
sounds weird to me too, although I guess there could be a script that was not allowed to do CORS that then instead created an inline script and did its CORS stuff in that script - about the only way I can think of it being bad.
- diggan 2y ago> although I guess there could be a script that was not allowed to do CORS that then instead created an inline script and did its CORS stuff in that script Wouldn't even matter, as it's the origin of wherever it ends up being executed that matters, not where the code was loaded from. So JS code loaded from cdn.jquery.com on mywebsite.com would have the origin mywebsite.com, even if loaded with a typical <script> tag. In short, CORS applies to network requests made by scripts, not to the scripts themselves
- bryanrasmussen 2y agoah yeah, sorry wasn't thinking clearly.