Hacker News Reader

It says right there in the proposal

> status quo CORS protections don’t protect against the kinds of attacks discussed here as they rely only on CORS-safelisted methods and CORS-safelisted request-headers. No preflight is triggered, and the attacker doesn’t actually care about reading the response, as the request itself is the CSRF attack.

View on HN

Ok, this will protect old unpatched vulnerable devices. But what will prevent a negligent manufacturer that uses HTTP GET without CSFR protection to apply configuration to the device from just adding the CORS opt-in header everywhere? I mean it would be the simplest solution for them.

But what about those vulnerabilities is specific to being on a private network? If we can find a public website with the same vulnerability, will we start enforcing stricter CORS requirements everywhere?

Reply on news.ycombinator.com