3 ms·
> Can you ensure that browsers or ad blockers won't block this kind of behaviour > [...] or try to get who you need to use CORS with to allow it on their domai
by esrauch 12y ago
> Can you ensure that browsers or ad blockers won't block this kind of behaviour
> [...] or try to get who you need to use CORS with to allow it on their domain?
There's no fundamental security difference between this and actual CORS since it requires the actual domain specifically serve a particular response to allow it. Either you have the ability to serve the proxy file from a particular domain and the general ability to set CORS headers, or you don't.
- e12e 12y agoI'm sorry, I've not looked at the code yet, but are you saying that being able to drop a html-file in some misconfigured servers public ftp-directory, or on some blogs upload folder is equivalent to being able to set http-headers? That's only true if CORS accept html-meta tags as replacement for http headers (which I don't think it does)? Again, I might be missing something, not having looked at the code yet, but it sounds like a rather strong statement.