Re: CORS

On Wed, 11 Oct 2017, 01:02 Jack (Zhan, Hua Ping),<jackiszhp@gmail.com>
wrote:

> Be aware that I do not serve his a.html GOOG ticker data with the CORS
> header. And the ticker data I will serve him is "{}".  If I serve him
> with a piece of JS: var objname={}. Then his a.html can always get the
> data as needed with a script element.


Some resources can be fetched without CORS (the spec calls these no-cors
requests), and some APIs can consume them under certain conditions, such as
img, media, CSS and script.

In many ways, this was a mistake, and they're a vector in a lot of privacy
attacks. Eg https://goo.gl/UPV32Q (pdf) which resulted in restrictions
being applied to CSS.

Although, it's worth noting that when site A executes a script from site B,
it is giving site B full control over the page and storage on its origin.