Julia EvansMar 4

I'm back to thinking about CSRF: why is it useful for sites to be able to embed resources (like <img src="othersite.com/whatever.jpg">) and for the browser to send the user's cookies to the third-party site?

There's "ads" and "tracking" obviously but I feel like there's another actually-useful-to-users reason I'm not thinking of

Show threadkeeferMar 4

@b0rk any time you have a different origin for a backend.

Eg api.example.com vs www.example.com

Example Domain

Show threadJulia Evans
@keefer i think i'm explaining it badly, I'm not trying to talk about CORS
Mar 4 at 8:10pmWeb