Post

Apparently it is a common misconception that browsers default handling of CORS protects servers from malicious requests. Where in reality, the intention is only to protect the client.

2/12/24, 7:47 pm0 reposts0 likes

logno

@logno.dev

2 Dec 2024

But then the server can provide headers and just say "oh no it's okay, you can take these resources." And then they could just serve some malicious resources anyway. So what's the point?