alt Hacker NewsI think cors can prevent that. You can't make a cross origin request from an origin that isn't allowlisted
Replies
inetknght • yesterday at 9:29 PM
You really think a server-controlled CORS list will protect you from a client-side configuration issue?
Timing attack on the preflight.