Timeline for How does setting Origin to null in a redirected CORS request protect against a confused deputy attack?
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 27, 2018 at 2:37 | comment | added | Jonah Benton | Yeah, maybe; it is hard really convey this kind of chain, though, especially when there may be different trust domains involved for the same Origin. CORS is only domain specific, not URI specific. | |
| Apr 26, 2018 at 23:31 | comment | added | Raniz | Thanks for the example, contrived or not :) IMO a better solution would be to include a redirect stack or something in the CORS preflight check. | |
| Apr 26, 2018 at 23:30 | vote | accept | Raniz | ||
| Apr 26, 2018 at 17:15 | history | answered | Jonah Benton | CC BY-SA 3.0 |