New answers tagged

0

Access-Control-Allow-Origin changes the protection offered to the end user in regards to how the Same Origin Policy handles AJAX responses. If a user is willing to mess around with host files in order to change this protection even further on their own, then the only thing they are compromising is their own security. The header allows another origin to ...


1

CORS policy limits what code loaded from site A and executed on your browser can do with site B, i.e. limits what cross-origin requests can do. It is not to restrict what can be done with site B in general, i.e. it cares only cross-origin requests and does not provide any kind of authentication control. You are right that you could in theory just modify ...


2

It's name says "allow" from which I understand that if I make a request from an "Origin" that is not allowed the request should fail. That is right (depending on the request). But disallowing a request is not a property of CORS, it's because of the same origin policy. CORS isn't really a header meant to secure anything, it's a header meant to weaken ...


2

GET and POST are methods used in basic linking, embedding and in submitting forms. These kind of interactions between sites predate the development of the same origin policy. If the same origin policy would be extended to incorporate POST and GET too then lots of sites would probably break. Therefore any POST and GET which can be created by linking, ...



Top 50 recent answers are included