3 ms·
That’s bad because visiting an evil site can easily trick your browser into performing one of those requests using your own credentials. CORS doesn’t stop the b
by paulhodge 1y ago
That’s bad because visiting an evil site can easily trick your browser into performing one of those requests using your own credentials. CORS doesn’t stop the backend state effect from happening.
- MajesticHobo2 1y agoThat's exactly why I don't agree that GETs should be broadly exempted from CSRF protections. I'm not talking about CORS at all.