Timeline for Origin header reflected in ACAO header with ACAC set to true on an API
Current License: CC BY-SA 4.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 15, 2021 at 21:50 | vote | accept | RespectableMan1337 | ||
| Nov 14, 2021 at 1:22 | answer | added | CBHacking | timeline score: 1 | |
| Nov 14, 2021 at 0:51 | comment | added | CBHacking | Do the preflights not also reflect the attacker's Origin header? If they do, then preflighting doesn't actually prevent anything, Origin-wise (it might prevent things like using certain headers, if for some reason it only allows those headers from first-party sites). | |
| Nov 13, 2021 at 1:55 | history | asked | RespectableMan1337 | CC BY-SA 4.0 |