Do You Really Know CORS? • Hacker News Board

Re: Do You Really Know CORS?

#61

Post by harshvladha » Thu, Oct 04, 2018, 5:04 AM UTC

meddlepal wrote: post #46

saganus wrote: post #41

Earlier quoted context omitted.

Genuine question: why do you feel you've cut your teeth more than most? I.e. what kind of dev work do you do that makes you have to deal with this more than the average developer?

Not OP, but my guess... Most devs aren't frontend devs and I would categorize this as mostly a frontend developer problem.

I think:

* Most devs are at least full stack

* Most apps now-a-days interact directly/indirectly with browser

* Attributing this problem to frontend devs without understanding why CORS and issues in handling that, makes you unaware of security issues with your backend services.

FYI: I am a backend developer.

Re: Do You Really Know CORS?

#62

Post by Benjamin_Dobell » Thu, Oct 04, 2018, 5:13 AM UTC

Klathmon wrote: post #7

This is an awesome overview! But don't take it as all encompassing, it doesn't go into some of the more esoteric edge cases with CORS, like: * either an unreleased safari version, or the most recent version will send preflight requests even if the request meets the spec (like if the Accept-Language is set to something they don't like). * If you use the ReadableStream API with fetch in the browser, a preflight will be…

Chrome's sendBeacon content-type CORS bug is another fun one:

https://bugs.chromium.org/p/chromium/issues/detail?id=490015

Re: Do You Really Know CORS?

#63

Post by rbirkby » Thu, Oct 04, 2018, 5:25 AM UTC

Klathmon wrote: post #7

This is an awesome overview! But don't take it as all encompassing, it doesn't go into some of the more esoteric edge cases with CORS, like: * either an unreleased safari version, or the most recent version will send preflight requests even if the request meets the spec (like if the Accept-Language is set to something they don't like). * If you use the ReadableStream API with fetch in the browser, a preflight will be…

Good points. Also, the strange case of access-control-allow-origin containing a list of origins. Or rather the lack of support for the whole standard.

Re: Do You Really Know CORS?

#64

Post by jpangs88 » Thu, Oct 04, 2018, 5:25 AM UTC

jhabdas wrote: post #50

I don't know CORS that well, but like any dev worth their weight in salt I know how to get around it: - iframe - domain js hack - reverse proxy - http header What else? Referrer Policies await.

I agree, the only thing I have ever found with CORS is that it makes it difficult for people who don't consider it when planning out servers should run. It goes like this:

- Just use my API...

- I tried, please enable CORS.

- What's CORS?

I find it frustrating that this seems to be the default for most servers. I think it should be opt in and not opt out.

Re: Do You Really Know CORS?

#65

Post by otabdeveloper2 » Thu, Oct 04, 2018, 5:26 AM UTC

> Do You Really Know CORS?

Of course I don't, nobody does.

Re: Do You Really Know CORS?

#66

Post by visarga » Thu, Oct 04, 2018, 5:49 AM UTC

zackmorris wrote: post #35

JepZ wrote: post #33

I never really understood why we have CORS. I mean, the problem with CSRF is that some random page can trick your browser into adding its authentication token to a request which does not originate from the authenticated page. So why the do we need the server to tell the browser that it should not send requests from other origins? In my opinion, it would have been much better to improve the browsers to not include coo…

Ya I generally think CORS is a waste of time. It would have been better to provide a hash of the file we're linking to and trust that rather than where it came from. Which is precisely what Subresource Integrity (SRI) does: https://en.wikipedia.org/wiki/Subresource_Integrity Sadly even though this is an obvious concept and trivial to implement, it took them over 20 years since the web came out to get it in most brows…

If they hashed and cashed the resource files, then they could be found locally most of the time.

Re: Do You Really Know CORS?

#67

Post by Moru » Thu, Oct 04, 2018, 5:53 AM UTC

Ajedi32 wrote: post #53

uyuyhay wrote: post #47

Please explain why browsers can't request and use any url as a regular curl command does (I'm explicit talking about request without sending browser cookies)

curl http://192.168.1.1/ Every site you visit would have unauthenticated read access to internal servers on your LAN, such as your router's home page.

Or your printers admin interface. Or your NAS.

Re: Do You Really Know CORS?

#68

Post by dasil003 » Thu, Oct 04, 2018, 6:09 AM UTC

jedberg wrote: post #29

My only experience with CORS has been when trying to access api.foo.com from a web page on foo.com, and then getting denied. Then I messed with the settings on api.foo.com trying to get it to allow access from foo.com, and then I gave up and just configured the load balancer on foo.com to proxy requests to foo.com/api to api.foo.com. So far it's only gotten in my way as a developer. But it's there to protect users, n…

You have it backwards. This type of request was not possible at all before CORS, CORS is what allows you to make it possible.

Re: Do You Really Know CORS?

#69

Post by matchagaucho » Thu, Oct 04, 2018, 6:12 AM UTC

3pt14159 wrote: post #6

I'm ideologically against third party on the web because it is a privacy nightmare. But I'm in the system that I'm in, and I don't take on fights that aren't possible to win, so barring my becoming a billionaire I've kinda just accepted that third party is here for at least a little while and I'm not going to refuse to use ads and analytics. Except on my personal website, that gets to stay cool. That said, CORS is th…

Our microservices stack is pretty dependent upon clients making cross-origin requests. I don't necessarily consider these "3rd party".

Re: Do You Really Know CORS?

#70

Post by dasil003 » Thu, Oct 04, 2018, 6:12 AM UTC

jpangs88 wrote: post #64

jhabdas wrote: post #50

I don't know CORS that well, but like any dev worth their weight in salt I know how to get around it: - iframe - domain js hack - reverse proxy - http header What else? Referrer Policies await.

I agree, the only thing I have ever found with CORS is that it makes it difficult for people who don't consider it when planning out servers should run. It goes like this: - Just use my API... - I tried, please enable CORS. - What's CORS? I find it frustrating that this seems to be the default for most servers. I think it should be opt in and not opt out.

In order to make it opt-in you’d need to disable cookies by default (at least for auth) or else you get massive pwnage by default.