Do You Really Know CORS?
I recently implemented a feature that depends on CORS and I don't see anything in this article that adds any value over Mozilla's thorough CORS docs.[1]<p>If you're writing an article on CORS today I also think you should mention recent CORS developments such as Cross-Origin Read Blocking (CORB)[2] and features on the horizon such as Cross-Origin-Resource-Policy, Cross-Origin-Window-Policy, etc. that in light of Spectre, Meltdown etc. are meant to help plug speculative execution holes.[3]<p>[1]: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS" rel="nofollow">https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS</a><p>[2]: <a href="https://www.chromium.org/Home/chromium-security/corb-for-developers" rel="nofollow">https://www.chromium.org/Home/chromium-security/corb-for-dev...</a><p>[3]: <a href="https://www.arturjanc.com/cross-origin-infoleaks.pdf" rel="nofollow">https://www.arturjanc.com/cross-origin-infoleaks.pdf</a>