3 ms·
CORS does nothing to address this problem. If you expose private data via CORS or JSONP you face the exact same problem. CORS solves a different problem, in t
by jcampbell1 14y ago
CORS does nothing to address this problem. If you expose private data via CORS or JSONP you face the exact same problem.
CORS solves a different problem, in that you don't have to eval 3rd party code. If the remote service provider gets hacked, then your site may not get compromised.
- fmavituna 14y agoThe issue is an external file can be called from a 3rd party website via "<script src=" and if the format is something that JavaScript interpreter understands then it's possible to hijack the data (so called JavaScript/JSON Hijacking). CORS solves it because you can WHITELIST the domains that can access the data, which is huge! Just like crossdomain.xml in Flash and ContenPolicy in Silverlight. You are right though if the format is still JSON you are still vulnerable to the same attack, however CORS doesn't require you to use any format particularly, so it's possibly to use any other data format.