Posted by Ricardo Iramar dos Santos on Sep 27
IE11 is not following CORS specification for local files like Chrome
and Firefox.
I’ve contacted Microsoft and they say this is not a security issue so
I’m sharing it.
files as supposed to be.
In order to prove I’ve created a malicious html file with the content below.
<html>
<script>
function createCORSRequest(method, url) {
var xhr = new XMLHttpRequest();
if (“withCredentials” in xhr) {…