2 ms·
what I meant was that I think allowing CORS or a similar mechanism is probably enough, and breaking apps like Dropbox is not a great idea, even if there is a no
by dvirsky 12y ago
what I meant was that I think allowing CORS or a similar mechanism is probably enough, and breaking apps like Dropbox is not a great idea, even if there is a non standard mechanism to override it.
- jorangreef 12y agoYes I agree, and WSS already has that mechanism in place. A similar point was also raised in the issues thread but has not been responded to.
- justinschuh 12y agoAs I explained elsewhere, the origin header in WS(S) allows a server to overtly protect itself from a client. Unlike CORS, it doesn't allow the browser to make security decisions regarding requests, and so would not address any of the attacks we're trying to prevent.