Browse Source

Added information about CORS security issue

master
Geoffrey Frogeye 3 years ago
parent
commit
57e2919f25
Signed by: geoffrey GPG Key ID: D8A7ECA00A8CD3DD
  1. 3
      dist/README.md

3
dist/README.md

@ -12,7 +12,10 @@ In order to block those, one can simply block the hostname `trackercompany.com`,
However, to circumvent this block, tracker companies made the websites using them load trackers from `somestring.website1.com`.
The latter is a DNS redirection to `website1.trackercompany.com`, directly to an IP address belonging to the tracking company.
Those are called first-party trackers.
On top of aforementionned privacy issues, they also cause some security issue, as websites are usually configured to trust first-party scripts.
For more information, learn about [Cross-Origin Resource Sharing](https://enable-cors.org/).
In order to block those trackers, ad blockers would need to block every subdomain pointing to anything under `trackercompany.com` or to their network.
Unfortunately, most don't support those blocking methods as they are not DNS-aware, e.g. they only see `somestring.website1.com`.

Loading…
Cancel
Save