Julia EvansFeb 4

something I don't think I've ever seen explained is whether there's any situation where it's safe to set "Access-Control-Allow-Origin: *" other than "if your site literally never serves any private data"

(I often hear "don't do it" which is fair I guess, but also like the Mastodon API intentionally sets Access-Control-Allow-Origin: * and that's extremely useful)

Show threadLisa Gaudette
@b0rk If you're building an API for arbitrary other people to call from the front end it needs to have * (and is then authenticated through something like OAuth tokens)
Feb 4 at 9:04pmWeb