3 ms·

This is also a misunderstanding. CORS only applies to the Layer 7 communication. The rest you can figure out from the timing of that. Significant components of

This is also a misunderstanding. CORS only applies to the Layer 7 communication. The rest you can figure out from the timing of that. Significant components of the browser, such as Websockets have no such restrictions at all

James_K 1y ago
Won't the browser still append the "Origin" field to WebSocket requests, allowing servers to reject them?
- bstsb 1y ago
  yes, and that's exactly how discord's websocket communication checks work (allowing them to offer a non-scheme "open in app" from the website). they also had some kind of RPC websocket system for game developers, but that appears to have been abandoned: https://discord.com/developers/docs/topics/rpc https://discord.com/developers/docs/topics/rpc
afiori 1y ago
A WebSocket starts as a normal http request, so it is subject to cors if the initial request was (eg if it was a post)
- odo1242 1y ago
  Unfortunately, the initial WebSocket HTTP request is defined to always be a GET request.
- hnav 1y ago
  websockets aren't subject to CORS, they send the initiating webpage in the Origin header but the server has to decide whether that's allowed.