Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

3
  • I misunderstood why the API was originally made, it was just a separate project. It wasn't made to get around CORS issues. And yes, it looks like it is entirely private. Commented Feb 25, 2019 at 19:53
  • 1
    "Of course CORS serves for the purpose of safely sharing data between different servers, hosting different applications, as API may reject any request[..]". This is misunderstanding how CORS works (to be fair the way CORS works is completely insane so that's no surprise): The API does not reject any request due to CORS, it just informs the client and then let's it reject the request. If you write your own client you have no trouble ignoring CORS completely. CORS is no security feature. Commented Oct 18, 2019 at 7:41
  • CORS (or more accurately the Same Origin Policy) is a security feature. Simply writing your own client isn't enough to defeat it unless you have privileged access to the system you want to attack. You'd have to write your own client, and get someone with privileged access to run it. Commented Feb 17, 2021 at 22:13