Developers don't understand CORS (2019)

A 2019 blog post highlights how many developers misunderstand CORS (Cross-Origin Resource Sharing), citing Zoom's security vulnerability as a prime example. Zoom created a localhost webserver to launch its native app but bypassed CORS security with an image-encoding hack instead of using proper CORS headers, inadvertently allowing any website on the internet to trigger privileged operations. The post emphasizes that implementing proper CORS headers with appropriate Access-Control-Allow-Origin values would have prevented this vulnerability and urges developers to use CORS security features rather than creating workarounds.