3 ms·
Yes I agree, and WSS already has that mechanism in place. A similar point was also raised in the issues thread but has not been responded to.
by jorangreef 12y ago
Yes I agree, and WSS already has that mechanism in place. A similar point was also raised in the issues thread but has not been responded to.
- justinschuh 12y agoAs I explained elsewhere, the origin header in WS(S) allows a server to overtly protect itself from a client. Unlike CORS, it doesn't allow the browser to make security decisions regarding requests, and so would not address any of the attacks we're trying to prevent.