3 ms·
Yes it's indeed correct and document. CORS safely solves this problem. http://en.wikipedia.org/wiki/Cross-origin_resource_sharing http://en.wikipedia.org/wiki/
by fmavituna 14y ago
Yes it's indeed correct and document.
CORS safely solves this problem.
http://en.wikipedia.org/wiki/Cross-origin_resource_sharing http://en.wikipedia.org/wiki/Cross-origin_resource_sharing
- neya 14y agoWow, thanks mate! I never knew of CORS before.. (I admit).
- jcampbell1 14y agoCORS does nothing to address this problem. If you expose private data via CORS or JSONP you face the exact same problem. CORS solves a different problem, in that you don't have to eval 3rd party code. If the remote service provider gets hacked, then your site may not get compromised.
- fmavituna 14y agoThe issue is an external file can be called from a 3rd party website via "<script src=" and if the format is something that JavaScript interpreter understands then it's possible to hijack the data (so called JavaScript/JSON Hijacking). CORS solves it because you can WHITELIST the domains that can access the data, which is huge! Just like crossdomain.xml in Flash and ContenPolicy in Silverlight. You are right though if the format is still JSON you are still vulnerable to the same attack, however CORS doesn't require you to use any format particularly, so it's possibly to use any other data format.