Hacker News Reader

There is already protection against this form of attack in the browser with CORS: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

View on HN

CORS doesn't help with compromised client code, since the CORS headers would allow access anyway.

CSP [1] can help by preventing malicious code to leak data to third parties, but it's far from trivial to close all loopholes. Especially with the myriad of tracking and other third party scripts most sites/apps use.

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

Reply on news.ycombinator.com