title: Cross-Origin Resource Sharing (CORS) - am I missing something here?
body: <p>I was reading about <a href="https://developer.mozilla.org/en/HTTP_access_control" rel="nofollow noreferrer">CORS</a> and I think the implementation is both simple and effective.</p>
  
  <p>However, unless I'm missing something, I think there's a big part missing from the spec. As I understand, it's the foreign site that decides, based on the origin of the request (and optionally including credentials), whether to allow access to its resources. This is fine.</p>
  
  <p>But what if malicious code on the page wants to POST a user's sensitive information to a foreign site? The foreign site is obviously going to authenticate the request. Hence, again if I'm not missing something, CORS actually makes it easier to steal sensitive information.</p>
  
  <p>I think it would have made much more sense if the original site could also supply an immutable list of servers its page is allowed to access. </p>
  
  <p>So the expanded sequence would be:</p>
  
  <ol>
  <li>Supply a page with list of acceptable CORS servers (abc.com, xyz.com, etc)</li>
  <li>Page wants to make an XHR request to abc.com - the browser allows this because it's in the allowed list and authentication proceeds as normal</li>
  <li>Page wants to make an XHR request to malicious.com - request rejected locally (ie by the browser) because the server is not in the list.</li>
  </ol>
  
  <p>I know that malicious code could still use JSONP to do its dirty work, but I would have thought that a complete implementation of CORS would imply the closing of the script tag multi-site loophole.</p>
  
  <p>I also checked out the official CORS spec (<a href="http://www.w3.org/TR/cors" rel="nofollow noreferrer">http://www.w3.org/TR/cors</a>) and could not find any mention of this issue.</p>