Re: Reports feature violates the same-origin policy

On Wed, Feb 15, 2017 at 6:22 PM, Daniel Veditz <dveditz@mozilla.com> wrote:
> So we change the MIME type to text/plain (allowed) and the text happens to
> be formatted as JSON. I don't see how that helps, but it would be
> spec-compliant.

That means that a server that accepts JSON payloads and carefully
checks the MIME type of the incoming request would not be vulnerable
if this was used maliciously somehow.


-- 
https://annevankesteren.nl/

Received on Wednesday, 15 February 2017 18:01:38 UTC