|
|
|
|
|
|
by bazoom42
38 days ago
|
|
|
It is the difference between opt-in and opt-out. Servers certainly can (and probably should) check request origin. But it is not something they usually do, since cross-domain requests from JavaScript wasn’t possible before CORS. If support for cross-domain request were introduced in browsers without requiring opt-in from servers, most sites would not be prepared against this new risk. It would open massive security issues across the web. |
|
|