&gt; It looks like this is possible because there is not an explicit &#x27;access-control-allow-origin&#x27; header set on facebook<p>CORS has nothing to do with it, actually. This is where the strength of the attack lies.