5 ms·

Every ad GET is doing a lot of things that violate that edict.

• xg15 3mo ago
  Yes, but if ads do it, that would at worst make the ad server vulnerable, not your server.
  • Beltiras 3mo ago
    You apparently understand less than me. The little I do understand is that CORS is protection for a site's user, not the site.
    • TeMPOraL 3mo ago
      It's a protection of site's business model.