3 ms·
I think you're confused. The only thing blocked would be client side fetch. You need to find another way to protect everything else.
by trick-or-treat 3mo ago
I think you're confused. The only thing blocked would be client side fetch. You need to find another way to protect everything else.
- vachina 3mo ago> The only thing blocked would be client side fetch. Exactly what I need. My API is public I just don’t want someone other than my own website to consume it. Is it that hard to understand?
- masklinn 3mo agoThat’s… not what cors does? CORS will only block browser-mediated “non-simple” requests, they don’t prevent other systems from accessing it as long as they don’t use a browser (or disable CORS in a headless browser).
- rnotaro 3mo agoI'm pretty sure they understand that since they wrote that the resources will need to be proxied. They just want to prevent hotlinking/leeching.
- masklinn 3mo agoSOP does not prevent hotlinking in the first place, a hotlink is simple request (the most simple if anything), CORS isn’t going to be in the path at all.
- deleted 3mo ago[deleted]
- trick-or-treat 3mo agoHotlinking/leeching applies to img or media assets, CORS offers NO protection from that AT ALL.
- trick-or-treat 3mo agocors is not about protecting your assets, you dummy. It's about protecting the rest of us FROM your assets.