New posts in Confused Deputy

How does setting Origin to null in a redirected CORS request protect against a confused deputy attack?