6 ms·
I bet there's an awful lot of servers out there that will happily take CORS requests from any host because someone didn't understand why their second domain cou
by robertclaus 3mo ago
I bet there's an awful lot of servers out there that will happily take CORS requests from any host because someone didn't understand why their second domain couldn't talk to the same API.
- ChadNauseam 3mo agoThat describes pretty much every server I've ever written lol.
- ivanjermakov 3mo agoSometimes it's a good thing when I try to use someone else's backend in my web app. For example map tile server or route builder, which are session-less and have no authentication. The idea that HTTP servers are restricted to requests from a single domain by default is strange, wonder if CORS world be better off opt-in rather than opt-out.
- kaoD 3mo ago> wonder if CORS world be better off opt-in rather than opt-out. It's necessary that the defaults are secure. More so, not less, if the problem is hard.