0

I know there are lots of posts on the same origin policy, but I specifically want to understand why it can't be done in this simpler way.

If evil.com makes sends a request to bank.com, browsers will not add cookies (so unauthenticated). Now you could have cross origin requests with no security issues?

7

0

Browse other questions tagged .