mozilla/browserid — Issue #767: Support (secure?) CORS requests to /verify
Author: broofa
Created: 2011-12-16 14:23:35+00:00
State: open

Can someone please elaborate on why CORS is not supported (and, in fact, was removed in 29a24826e856b29b0025bd614092765662e1f52b)?

I assume the answer lies in the general tone of the security wiki page, that hints at how client verification is generally considered to be bad practice. That said, being able to do verification on the client is pretty appealing. Both for testing purposes, and as a way of enabling client-only applications that allow for identification.