109 reputation
2
bio website brillout.com
location Berlin, Germany
age
visits member for 1 year, 9 months
seen Jan 1 at 20:42

Nov
27
comment Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *)
I really doubt it to be the case. This would otherwise pose a considerable security issue with CORS. I didn't read the spec so I'm not entirely sure but my guess is that the purpose of the preflight is to avoid the following catch 22: the browser needs to send the request to know if and how the CORS response headers are set, but if the browser sends the request to realize that no CORS headers are set, then it just did a request that it is not suppose to do
Nov
27
comment Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *)
I meant; no cookies are sent because they aren't allowed as per Access-Control-Allow-Credentials: false
Nov
27
comment Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *)
The second link provides some information but still tackles the question from quite a different angle. As for the other links they don't provide any information whatsoever related to my question
Nov
27
comment Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *)
As already mentioned in the question, no cookies are sent
Nov
27
awarded  Student
Nov
27
asked Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *)
Nov
8
awarded  Supporter