5 ms·
"Thankfully, CORS lets modern browsers go cross-browser safely, even with private data if things are configured right." Would you clarify or add some pointers
by facorreia 14y ago
"Thankfully, CORS lets modern browsers go cross-browser safely, even with private data if things are configured right."
Would you clarify or add some pointers to where we can learn about CORS benefits for private data? CSRF is a huge but often underestimated issue.
- byroot 14y agoThere is not CORS benefits for private data if your CORS endpoint have a cookie based authentication.
- mmahemoff 14y agoActually as yoghur points out, CORS doesn't protect against CSRF. A token must be passed for any privileged calls. That said, a benefit of CORS is the ability to do non-GET methods. So it's safer in the sense of HTTP idempotence, ie you can change server state safely, using POSTs, DELETEs, and so on. You'd still need to pass a token, however. (Of course I meant cross-domain, not cross-browser :).