Hacker News Reader

Comment by gorhill | Hacker News Reader

I can't make this work on my side, both Chromium and Firefox block the requests for the font resources from l0.cm (because CORS policy):

    Font from origin 'http://l0.cm' has been blocked from loading by Cross-Origin Resource Sharing policy:
    No 'Access-Control-Allow-Origin' header is present on the requested resource.
    Origin 'http://lepunk.co.uk' is therefore not allowed access.

View on HN

That warning just stops the font from being visible to the victim.

I'm pretty sure the requests still go to the attacker.

> I'm pretty sure the requests still go to the attacker

You are right, they do, it's just that the returned data is not allowed to be seen/used by the page -- the "l0.cm" server still got the information.

i think thats just a matter of adding this header on the server side Access-Control-Allow-Origin:

Reply on news.ycombinator.com