CORS is Stupid - Kevin Cox
CORS is Stupid - Kevin Cox
You're viewing a single thread.
-
Thanks, very interesting. I'm a bit confused about what this means:
explicit credentials are unsuitable for server-rendered sites as they aren’t included in top-level navigation
What does "top-level navigation" mean here?
-
‘’’ Note: When I say “top-level” I am talking about the URL that you see in the address bar. So if you load fun-games.example in your URL bar and it makes a request to your-bank.example then fun-games.example is the top-level site. ‘’’ Meaning explicit creds won’t be sent. Even if fun-games knows how to send explicit creds, it can’t because fun-games does not have access to creds which stored for your-bank. Say suppose your-bank creds stored in local store. Since current URL is fun-games it can only access local storage of fun-games, not your-bank.
-