root
/
spring-framework
mirror of https://github.com/spring-projects/spring-framework.git
1
0
Fork 0
Code Issues Actions 8 Packages Projects Releases Wiki Activity

URL Cleanup - polishing

This commit is contained in:
Sam Brannen 2019-03-28 17:17:32 +01:00
parent faa3bde991
commit 3f85530efd
17 changed files with 44 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
spring-core/src/test/java/org/springframework/util/xml/SimpleNamespaceContextTests.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2016 the original author or authors. * Copyright 2002-2019 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -50,10 +50,10 @@ public class SimpleNamespaceContextTests {
@Test @Test
public void getNamespaceURI() { public void getNamespaceURI() {
context.bindNamespaceUri(XMLConstants.XMLNS_ATTRIBUTE, additionalNamespaceUri); context.bindNamespaceUri(XMLConstants.XMLNS_ATTRIBUTE, additionalNamespaceUri);
assertThat("Always returns \"https://www.w3.org/2000/xmlns/\" for \"xmlns\"", assertThat("Always returns \"http://www.w3.org/2000/xmlns/\" for \"xmlns\"",
context.getNamespaceURI(XMLConstants.XMLNS_ATTRIBUTE), is(XMLConstants.XMLNS_ATTRIBUTE_NS_URI)); context.getNamespaceURI(XMLConstants.XMLNS_ATTRIBUTE), is(XMLConstants.XMLNS_ATTRIBUTE_NS_URI));
context.bindNamespaceUri(XMLConstants.XML_NS_PREFIX, additionalNamespaceUri); context.bindNamespaceUri(XMLConstants.XML_NS_PREFIX, additionalNamespaceUri);
assertThat("Always returns \"https://www.w3.org/XML/1998/namespace\" for \"xml\"", assertThat("Always returns \"http://www.w3.org/XML/1998/namespace\" for \"xml\"",
context.getNamespaceURI(XMLConstants.XML_NS_PREFIX), is(XMLConstants.XML_NS_URI)); context.getNamespaceURI(XMLConstants.XML_NS_PREFIX), is(XMLConstants.XML_NS_URI));
assertThat("Returns \"\" for an unbound prefix", context.getNamespaceURI(unboundPrefix), assertThat("Returns \"\" for an unbound prefix", context.getNamespaceURI(unboundPrefix),
@ -76,9 +76,9 @@ public class SimpleNamespaceContextTests {
@Test @Test
public void getPrefix() { public void getPrefix() {
assertThat("Always returns \"xmlns\" for \"https://www.w3.org/2000/xmlns/\"", assertThat("Always returns \"xmlns\" for \"http://www.w3.org/2000/xmlns/\"",
context.getPrefix(XMLConstants.XMLNS_ATTRIBUTE_NS_URI), is(XMLConstants.XMLNS_ATTRIBUTE)); context.getPrefix(XMLConstants.XMLNS_ATTRIBUTE_NS_URI), is(XMLConstants.XMLNS_ATTRIBUTE));
assertThat("Always returns \"xml\" for \"https://www.w3.org/XML/1998/namespace\"", assertThat("Always returns \"xml\" for \"http://www.w3.org/XML/1998/namespace\"",
context.getPrefix(XMLConstants.XML_NS_URI), is(XMLConstants.XML_NS_PREFIX)); context.getPrefix(XMLConstants.XML_NS_URI), is(XMLConstants.XML_NS_PREFIX));
assertThat("Returns null for an unbound namespace URI", context.getPrefix(unboundNamespaceUri), assertThat("Returns null for an unbound namespace URI", context.getPrefix(unboundNamespaceUri),
@ -103,10 +103,10 @@ public class SimpleNamespaceContextTests {
@Test @Test
public void getPrefixes() { public void getPrefixes() {
assertThat("Returns only \"xmlns\" for \"https://www.w3.org/2000/xmlns/\"", assertThat("Returns only \"xmlns\" for \"http://www.w3.org/2000/xmlns/\"",
getItemSet(context.getPrefixes(XMLConstants.XMLNS_ATTRIBUTE_NS_URI)), getItemSet(context.getPrefixes(XMLConstants.XMLNS_ATTRIBUTE_NS_URI)),
is(makeSet(XMLConstants.XMLNS_ATTRIBUTE))); is(makeSet(XMLConstants.XMLNS_ATTRIBUTE)));
assertThat("Returns only \"xml\" for \"https://www.w3.org/XML/1998/namespace\"", assertThat("Returns only \"xml\" for \"http://www.w3.org/XML/1998/namespace\"",
getItemSet(context.getPrefixes(XMLConstants.XML_NS_URI)), is(makeSet(XMLConstants.XML_NS_PREFIX))); getItemSet(context.getPrefixes(XMLConstants.XML_NS_URI)), is(makeSet(XMLConstants.XML_NS_PREFIX)));
assertThat("Returns empty iterator for unbound prefix", context.getPrefixes("unbound Namespace URI").hasNext(), assertThat("Returns empty iterator for unbound prefix", context.getPrefixes("unbound Namespace URI").hasNext(),

2
spring-tx/src/main/java/org/springframework/jca/context/SpringContextResourceAdapter.java
View File

@ -71,7 +71,7 @@ import org.springframework.util.StringUtils;
* <?xml version="1.0" encoding="UTF-8"?> * <?xml version="1.0" encoding="UTF-8"?>
* <connector xmlns="http://java.sun.com/xml/ns/j2ee" * <connector xmlns="http://java.sun.com/xml/ns/j2ee"
* xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" * xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
* xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/connector_1_5.xsd" * xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee https://java.sun.com/xml/ns/j2ee/connector_1_5.xsd"
* version="1.5"> * version="1.5">
* <vendor-name>Spring Framework</vendor-name> * <vendor-name>Spring Framework</vendor-name>
* <eis-type>Spring Connector</eis-type> * <eis-type>Spring Connector</eis-type>

16
spring-web/src/main/java/org/springframework/http/HttpHeaders.java
View File

@ -102,42 +102,42 @@ public class HttpHeaders implements MultiValueMap<String, String>, Serializable
public static final String ACCEPT_RANGES = "Accept-Ranges"; public static final String ACCEPT_RANGES = "Accept-Ranges";
/** /**
* The CORS {@code Access-Control-Allow-Credentials} response header field name. * The CORS {@code Access-Control-Allow-Credentials} response header field name.
* @see <a href="http://www.w3.org/TR/cors/">CORS W3C recommendation</a> * @see <a href="https://www.w3.org/TR/cors/">CORS W3C recommendation</a>
*/ */
public static final String ACCESS_CONTROL_ALLOW_CREDENTIALS = "Access-Control-Allow-Credentials"; public static final String ACCESS_CONTROL_ALLOW_CREDENTIALS = "Access-Control-Allow-Credentials";
/** /**
* The CORS {@code Access-Control-Allow-Headers} response header field name. * The CORS {@code Access-Control-Allow-Headers} response header field name.
* @see <a href="http://www.w3.org/TR/cors/">CORS W3C recommendation</a> * @see <a href="https://www.w3.org/TR/cors/">CORS W3C recommendation</a>
*/ */
public static final String ACCESS_CONTROL_ALLOW_HEADERS = "Access-Control-Allow-Headers"; public static final String ACCESS_CONTROL_ALLOW_HEADERS = "Access-Control-Allow-Headers";
/** /**
* The CORS {@code Access-Control-Allow-Methods} response header field name. * The CORS {@code Access-Control-Allow-Methods} response header field name.
* @see <a href="http://www.w3.org/TR/cors/">CORS W3C recommendation</a> * @see <a href="https://www.w3.org/TR/cors/">CORS W3C recommendation</a>
*/ */
public static final String ACCESS_CONTROL_ALLOW_METHODS = "Access-Control-Allow-Methods"; public static final String ACCESS_CONTROL_ALLOW_METHODS = "Access-Control-Allow-Methods";
/** /**
* The CORS {@code Access-Control-Allow-Origin} response header field name. * The CORS {@code Access-Control-Allow-Origin} response header field name.
* @see <a href="http://www.w3.org/TR/cors/">CORS W3C recommendation</a> * @see <a href="https://www.w3.org/TR/cors/">CORS W3C recommendation</a>
*/ */
public static final String ACCESS_CONTROL_ALLOW_ORIGIN = "Access-Control-Allow-Origin"; public static final String ACCESS_CONTROL_ALLOW_ORIGIN = "Access-Control-Allow-Origin";
/** /**
* The CORS {@code Access-Control-Expose-Headers} response header field name. * The CORS {@code Access-Control-Expose-Headers} response header field name.
* @see <a href="http://www.w3.org/TR/cors/">CORS W3C recommendation</a> * @see <a href="https://www.w3.org/TR/cors/">CORS W3C recommendation</a>
*/ */
public static final String ACCESS_CONTROL_EXPOSE_HEADERS = "Access-Control-Expose-Headers"; public static final String ACCESS_CONTROL_EXPOSE_HEADERS = "Access-Control-Expose-Headers";
/** /**
* The CORS {@code Access-Control-Max-Age} response header field name. * The CORS {@code Access-Control-Max-Age} response header field name.
* @see <a href="http://www.w3.org/TR/cors/">CORS W3C recommendation</a> * @see <a href="https://www.w3.org/TR/cors/">CORS W3C recommendation</a>
*/ */
public static final String ACCESS_CONTROL_MAX_AGE = "Access-Control-Max-Age"; public static final String ACCESS_CONTROL_MAX_AGE = "Access-Control-Max-Age";
/** /**
* The CORS {@code Access-Control-Request-Headers} request header field name. * The CORS {@code Access-Control-Request-Headers} request header field name.
* @see <a href="http://www.w3.org/TR/cors/">CORS W3C recommendation</a> * @see <a href="https://www.w3.org/TR/cors/">CORS W3C recommendation</a>
*/ */
public static final String ACCESS_CONTROL_REQUEST_HEADERS = "Access-Control-Request-Headers"; public static final String ACCESS_CONTROL_REQUEST_HEADERS = "Access-Control-Request-Headers";
/** /**
* The CORS {@code Access-Control-Request-Method} request header field name. * The CORS {@code Access-Control-Request-Method} request header field name.
* @see <a href="http://www.w3.org/TR/cors/">CORS W3C recommendation</a> * @see <a href="https://www.w3.org/TR/cors/">CORS W3C recommendation</a>
*/ */
public static final String ACCESS_CONTROL_REQUEST_METHOD = "Access-Control-Request-Method"; public static final String ACCESS_CONTROL_REQUEST_METHOD = "Access-Control-Request-Method";
/** /**

2
spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java
View File

@ -45,7 +45,7 @@ import org.springframework.util.StringUtils;
* @author Juergen Hoeller * @author Juergen Hoeller
* @author Sam Brannen * @author Sam Brannen
* @since 4.2 * @since 4.2
* @see <a href="http://www.w3.org/TR/cors/">CORS spec</a> * @see <a href="https://www.w3.org/TR/cors/">CORS spec</a>
*/ */
public class CorsConfiguration { public class CorsConfiguration {

2
spring-web/src/main/java/org/springframework/web/cors/CorsProcessor.java
View File

@ -34,7 +34,7 @@ import org.springframework.lang.Nullable;
* @author Sebastien Deleuze * @author Sebastien Deleuze
* @author Rossen Stoyanchev * @author Rossen Stoyanchev
* @since 4.2 * @since 4.2
* @see <a href="http://www.w3.org/TR/cors/">CORS W3C recommendation</a> * @see <a href="https://www.w3.org/TR/cors/">CORS W3C recommendation</a>
* @see org.springframework.web.servlet.handler.AbstractHandlerMapping#setCorsProcessor * @see org.springframework.web.servlet.handler.AbstractHandlerMapping#setCorsProcessor
*/ */
public interface CorsProcessor { public interface CorsProcessor {

2
spring-web/src/main/java/org/springframework/web/cors/CorsUtils.java
View File

@ -23,7 +23,7 @@ import org.springframework.http.HttpMethod;
/** /**
* Utility class for CORS request handling based on the * Utility class for CORS request handling based on the
* <a href="http://www.w3.org/TR/cors/">CORS W3C recommendation</a>. * <a href="https://www.w3.org/TR/cors/">CORS W3C recommendation</a>.
* *
* @author Sebastien Deleuze * @author Sebastien Deleuze
* @since 4.2 * @since 4.2

2
spring-web/src/main/java/org/springframework/web/cors/DefaultCorsProcessor.java
View File

@ -40,7 +40,7 @@ import org.springframework.web.util.WebUtils;
/** /**
* The default implementation of {@link CorsProcessor}, as defined by the * The default implementation of {@link CorsProcessor}, as defined by the
* <a href="http://www.w3.org/TR/cors/">CORS W3C recommendation</a>. * <a href="https://www.w3.org/TR/cors/">CORS W3C recommendation</a>.
* *
* <p>Note that when input {@link CorsConfiguration} is {@code null}, this * <p>Note that when input {@link CorsConfiguration} is {@code null}, this
* implementation does not reject simple or actual requests outright but simply * implementation does not reject simple or actual requests outright but simply

2
spring-web/src/main/java/org/springframework/web/cors/reactive/CorsProcessor.java
View File

@ -28,7 +28,7 @@ import org.springframework.web.server.ServerWebExchange;
* @author Sebastien Deleuze * @author Sebastien Deleuze
* @author Rossen Stoyanchev * @author Rossen Stoyanchev
* @since 5.0 * @since 5.0
* @see <a href="http://www.w3.org/TR/cors/">CORS W3C recommendation</a> * @see <a href="https://www.w3.org/TR/cors/">CORS W3C recommendation</a>
*/ */
public interface CorsProcessor { public interface CorsProcessor {

2
spring-web/src/main/java/org/springframework/web/cors/reactive/CorsUtils.java
View File

@ -28,7 +28,7 @@ import org.springframework.web.util.UriComponentsBuilder;
/** /**
* Utility class for CORS reactive request handling based on the * Utility class for CORS reactive request handling based on the
* <a href="http://www.w3.org/TR/cors/">CORS W3C recommendation</a>. * <a href="https://www.w3.org/TR/cors/">CORS W3C recommendation</a>.
* *
* @author Sebastien Deleuze * @author Sebastien Deleuze
* @since 5.0 * @since 5.0

2
spring-web/src/main/java/org/springframework/web/cors/reactive/CorsWebFilter.java
View File

@ -39,7 +39,7 @@ import org.springframework.web.server.WebFilterChain;
* *
* @author Sebastien Deleuze * @author Sebastien Deleuze
* @since 5.0 * @since 5.0
* @see <a href="http://www.w3.org/TR/cors/">CORS W3C recommendation</a> * @see <a href="https://www.w3.org/TR/cors/">CORS W3C recommendation</a>
*/ */
public class CorsWebFilter implements WebFilter { public class CorsWebFilter implements WebFilter {

2
spring-web/src/main/java/org/springframework/web/cors/reactive/DefaultCorsProcessor.java
View File

@ -35,7 +35,7 @@ import org.springframework.web.server.ServerWebExchange;
/** /**
* The default implementation of {@link CorsProcessor}, * The default implementation of {@link CorsProcessor},
* as defined by the <a href="http://www.w3.org/TR/cors/">CORS W3C recommendation</a>. * as defined by the <a href="https://www.w3.org/TR/cors/">CORS W3C recommendation</a>.
* *
* <p>Note that when input {@link CorsConfiguration} is {@code null}, this * <p>Note that when input {@link CorsConfiguration} is {@code null}, this
* implementation does not reject simple or actual requests outright but simply * implementation does not reject simple or actual requests outright but simply

2
spring-web/src/main/java/org/springframework/web/filter/CorsFilter.java
View File

@ -48,7 +48,7 @@ import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
* *
* @author Sebastien Deleuze * @author Sebastien Deleuze
* @since 4.2 * @since 4.2
* @see <a href="http://www.w3.org/TR/cors/">CORS W3C recommendation</a> * @see <a href="https://www.w3.org/TR/cors/">CORS W3C recommendation</a>
*/ */
public class CorsFilter extends OncePerRequestFilter { public class CorsFilter extends OncePerRequestFilter {

2
spring-web/src/main/java/org/springframework/web/util/HtmlCharacterEntityReferences.java
View File

@ -31,7 +31,7 @@ import org.springframework.util.Assert;
* HTML 4.0 standard. * HTML 4.0 standard.
* *
* <p>A complete description of the HTML 4.0 character set can be found * <p>A complete description of the HTML 4.0 character set can be found
* at http://www.w3.org/TR/html4/charset.html. * at https://www.w3.org/TR/html4/charset.html.
* *
* @author Juergen Hoeller * @author Juergen Hoeller
* @author Martin Kersten * @author Martin Kersten

30
spring-web/src/main/java/org/springframework/web/util/HtmlUtils.java
View File

@ -24,7 +24,7 @@ import org.springframework.util.Assert;
* character entity references. * character entity references.
* *
* <p>Reference: * <p>Reference:
* <a href="http://www.w3.org/TR/html4/charset.html">http://www.w3.org/TR/html4/charset.html</a> * <a href="https://www.w3.org/TR/html4/charset.html">https://www.w3.org/TR/html4/charset.html</a>
* *
* <p>For a comprehensive set of String escaping utilities, * <p>For a comprehensive set of String escaping utilities,
* consider Apache Commons Lang and its StringEscapeUtils class. * consider Apache Commons Lang and its StringEscapeUtils class.
@ -52,8 +52,8 @@ public abstract class HtmlUtils {
* <p>Escapes all special characters to their corresponding * <p>Escapes all special characters to their corresponding
* entity reference (e.g. {@code &lt;}). * entity reference (e.g. {@code &lt;}).
* <p>Reference: * <p>Reference:
* <a href="http://www.w3.org/TR/html4/sgml/entities.html"> * <a href="https://www.w3.org/TR/html4/sgml/entities.html">
* http://www.w3.org/TR/html4/sgml/entities.html * https://www.w3.org/TR/html4/sgml/entities.html
* </a> * </a>
* @param input the (unescaped) input string * @param input the (unescaped) input string
* @return the escaped string * @return the escaped string
@ -70,8 +70,8 @@ public abstract class HtmlUtils {
* specified encoding. In other words, if a special character does * specified encoding. In other words, if a special character does
* not have to be escaped for the given encoding, it may not be. * not have to be escaped for the given encoding, it may not be.
* <p>Reference: * <p>Reference:
* <a href="http://www.w3.org/TR/html4/sgml/entities.html"> * <a href="https://www.w3.org/TR/html4/sgml/entities.html">
* http://www.w3.org/TR/html4/sgml/entities.html * https://www.w3.org/TR/html4/sgml/entities.html
* </a> * </a>
* @param input the (unescaped) input string * @param input the (unescaped) input string
* @param encoding the name of a supported {@link java.nio.charset.Charset charset} * @param encoding the name of a supported {@link java.nio.charset.Charset charset}
@ -101,8 +101,8 @@ public abstract class HtmlUtils {
* <p>Escapes all special characters to their corresponding numeric * <p>Escapes all special characters to their corresponding numeric
* reference in decimal format (&#<i>Decimal</i>;). * reference in decimal format (&#<i>Decimal</i>;).
* <p>Reference: * <p>Reference:
* <a href="http://www.w3.org/TR/html4/sgml/entities.html"> * <a href="https://www.w3.org/TR/html4/sgml/entities.html">
* http://www.w3.org/TR/html4/sgml/entities.html * https://www.w3.org/TR/html4/sgml/entities.html
* </a> * </a>
* @param input the (unescaped) input string * @param input the (unescaped) input string
* @return the escaped string * @return the escaped string
@ -119,8 +119,8 @@ public abstract class HtmlUtils {
* specified encoding. In other words, if a special character does * specified encoding. In other words, if a special character does
* not have to be escaped for the given encoding, it may not be. * not have to be escaped for the given encoding, it may not be.
* <p>Reference: * <p>Reference:
* <a href="http://www.w3.org/TR/html4/sgml/entities.html"> * <a href="https://www.w3.org/TR/html4/sgml/entities.html">
* http://www.w3.org/TR/html4/sgml/entities.html * https://www.w3.org/TR/html4/sgml/entities.html
* </a> * </a>
* @param input the (unescaped) input string * @param input the (unescaped) input string
* @param encoding the name of a supported {@link java.nio.charset.Charset charset} * @param encoding the name of a supported {@link java.nio.charset.Charset charset}
@ -151,8 +151,8 @@ public abstract class HtmlUtils {
* <p>Escapes all special characters to their corresponding numeric * <p>Escapes all special characters to their corresponding numeric
* reference in hex format (&#x<i>Hex</i>;). * reference in hex format (&#x<i>Hex</i>;).
* <p>Reference: * <p>Reference:
* <a href="http://www.w3.org/TR/html4/sgml/entities.html"> * <a href="https://www.w3.org/TR/html4/sgml/entities.html">
* http://www.w3.org/TR/html4/sgml/entities.html * https://www.w3.org/TR/html4/sgml/entities.html
* </a> * </a>
* @param input the (unescaped) input string * @param input the (unescaped) input string
* @return the escaped string * @return the escaped string
@ -169,8 +169,8 @@ public abstract class HtmlUtils {
* specified encoding. In other words, if a special character does * specified encoding. In other words, if a special character does
* not have to be escaped for the given encoding, it may not be. * not have to be escaped for the given encoding, it may not be.
* <p>Reference: * <p>Reference:
* <a href="http://www.w3.org/TR/html4/sgml/entities.html"> * <a href="https://www.w3.org/TR/html4/sgml/entities.html">
* http://www.w3.org/TR/html4/sgml/entities.html * https://www.w3.org/TR/html4/sgml/entities.html
* </a> * </a>
* @param input the (unescaped) input string * @param input the (unescaped) input string
* @param encoding the name of a supported {@link java.nio.charset.Charset charset} * @param encoding the name of a supported {@link java.nio.charset.Charset charset}
@ -208,8 +208,8 @@ public abstract class HtmlUtils {
* Gracefully handles malformed character references by copying original * Gracefully handles malformed character references by copying original
* characters as is when encountered.<p> * characters as is when encountered.<p>
* <p>Reference: * <p>Reference:
* <a href="http://www.w3.org/TR/html4/sgml/entities.html"> * <a href="https://www.w3.org/TR/html4/sgml/entities.html">
* http://www.w3.org/TR/html4/sgml/entities.html * https://www.w3.org/TR/html4/sgml/entities.html
* </a> * </a>
* @param input the (escaped) input string * @param input the (escaped) input string
* @return the unescaped string * @return the unescaped string

2
spring-web/src/test/java/org/springframework/web/filter/ForwardedHeaderFilterTests.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2018 the original author or authors. * Copyright 2002-2019 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.

2
src/docs/asciidoc/web/webflux-cors.adoc
View File

@ -17,7 +17,7 @@ For example, you could have your bank account in one tab and evil.com in another
from evil.com should not be able to make AJAX requests to your bank API with your from evil.com should not be able to make AJAX requests to your bank API with your
credentials -- for example, withdrawing money from your account! credentials -- for example, withdrawing money from your account!
Cross-Origin Resource Sharing (CORS) is a http://www.w3.org/TR/cors/[W3C specification] Cross-Origin Resource Sharing (CORS) is a https://www.w3.org/TR/cors/[W3C specification]
implemented by https://caniuse.com/#feat=cors[most browsers] that lets you specify implemented by https://caniuse.com/#feat=cors[most browsers] that lets you specify
what kind of cross-domain requests are authorized, rather than using less secure and less what kind of cross-domain requests are authorized, rather than using less secure and less
powerful workarounds based on IFRAME or JSONP. powerful workarounds based on IFRAME or JSONP.

2
src/docs/asciidoc/web/webmvc-cors.adoc
View File

@ -17,7 +17,7 @@ For example, you could have your bank account in one tab and evil.com in another
from evil.com should not be able to make AJAX requests to your bank API with your from evil.com should not be able to make AJAX requests to your bank API with your
credentials -- for example withdrawing money from your account! credentials -- for example withdrawing money from your account!
Cross-Origin Resource Sharing (CORS) is a http://www.w3.org/TR/cors/[W3C specification] Cross-Origin Resource Sharing (CORS) is a https://www.w3.org/TR/cors/[W3C specification]
implemented by https://caniuse.com/#feat=cors[most browsers] that lets you specify implemented by https://caniuse.com/#feat=cors[most browsers] that lets you specify
what kind of cross-domain requests are authorized, rather than using less secure and less what kind of cross-domain requests are authorized, rather than using less secure and less
powerful workarounds based on IFRAME or JSONP. powerful workarounds based on IFRAME or JSONP.