21–30 of 127 posts
Earlier quoted context omitted.
> rather than just enforcing access itself. Could you elaborate on that? I can't picture the alternative you're suggesting.
The alternative is for the idea agent to send the Origin header on all requests. Then the server responds with 200 or 403.
This is really an informative article. We've recently stumbled across this issues and all other pages I could google did not explain it as clearly as this page.
My only contribution to the discussion is that if you get a CORS error where you wouldn't expect it, the problem might not be a CORS issue. I spent the better part of a weekend trying to debug why a request to a Google API wasn't working and why I was seeing a CORS error (same thing worked fine on another system). Turns out, it wasn't the same thing, my url had a typo...
Earlier quoted context omitted.
The alternative is for the idea agent to send the Origin header on all requests. Then the server responds with 200 or 403.
The origin could still be falsified client-side.
Earlier quoted context omitted.
> rather than just enforcing access itself. Could you elaborate on that? I can't picture the alternative you're suggesting.
The alternative is for the idea agent to send the Origin header on all requests. Then the server responds with 200 or 403.
JWT/tokens + Local/session storage + adding fetch headers seems like the best way as long as you don't run untrusted JS.
Too ironic not to mention.
Had to deal with a firewall that filtered all unknown/"new" HTTP headers. This included CORS. A PITA to find the reason why Firefox wouldn't use the Google fonts.
I'm ideologically against third party on the web because it is a privacy nightmare. But I'm in the system that I'm in, and I don't take on fights that aren't possible to win, so barring my becoming a billionaire I've kinda just accepted that third party is here for at least a little while and I'm not going to refuse to use ads and analytics. Except on my personal website, that gets to stay cool. That said, CORS is th…
CORS is not necessarily about third parties. It's common to have app.example.org point to a CDN and api.example.org point to an API. And CORS implementation is terrible. The server has to transmit validation rules for the browser to enforce (with vendor specific caching differences), rather than just enforcing access itself. The reason it's implemented this way is because of the organic evolution of web security.
That's a typical misunderstanding of purpose of CORS. Regardless of your website setting or not setting CORS, an attacker with a modified browser or a custom browser can ignore it. That's not what CORS protects from - CORS protects against a non-modified browser uased by Joe Random User installed via a factory/distribution path being tricked into doing something against the site policy, therefore exposing the user.
So far it's only gotten in my way as a developer. But it's there to protect users, not me. So at the end of the day, I'm glad it's there as a way to somewhat prevent people from tricking my users into hitting my api with malicious requests.
Had to deal with a firewall that filtered all unknown/"new" HTTP headers. This included CORS. A PITA to find the reason why Firefox wouldn't use the Google fonts.
That kind of crapware is why I'm increasingly glad that the http specs are moving towards being completely illegible to middleware boxes.