Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I dont understand how is it possible that browser would allow crossdomain request from attacker website to victim website? Unless victim has some CORS headers allowing all sites to query it?


Wouldn't the browser still make the request even with the CORS headers, because the server needs to send such headers?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: