undefined | Better HN

0 pointszemnmez4y ago0 comments

CORS tries to prevent CSRF issues by preventing cross-origin cookie authentication.

0 comments

2 comments · 1 top-level

jefftk4y ago· 1 in thread

Sure, but moving your whole app under a single origin to avoid dealing with CORS doesn't weaken any protection here.

if handled correctly, sure. but it also means that implicit cookie authentication ('ambient authority') is possible and can easily happen by accident

j / k navigate · click thread line to collapse