91–100 of 127 posts
How do you prevent people proxying your API via a node service? This is something I could never get my head around with CORS - what's the point of whitelisting origins if getting around the whitelist is nothing more than an inconvenience?
Earlier quoted context omitted.
The entire webstack is such a broken mess of inconsistencies and thousands of hidden traps that can render the entire thing insecure. People moan about C yet I find the web stack greatly more painful to write because you didn't even have control over the compiler following standards strictly (where stuff has even been standardised). I really do wish we worked together to create a new standard for building and deployi…
The web is the state it's in because it's a no-mans-land between warring proprietary vendors. Any one of Apple, Microsoft, or Google (even secondary players like Amazon, Oracle, or Valve) would much prefer a world in which they had the dominant platform and could get a 30% cut and arbitrary veto over all software written for that platform.
There have been other examples in history where programming languages used to differ - sometimes even significantly - depending on which compiler / platform you were targeting and where a standards body later stepped in to create a basic subset of said language that should be universal across all dialects (please note they cannot enforce this). In those instances that has lead to code to become greatly more portable.
To some extent, this is now happening with the web as well; however my secondary point to the complaint about differing outputs between browsers is that I believe HTML et al is a lousy way to design applications from the outset. That definitely is not a problem created by warring proprietary vendors or slow revisions of standards but rather just an artefact of technology evolving past it's original purpose yet still having to retain backwards compatibility. Maybe the time has come that we need a second language for the web so we have HTML et al for legacy applications, blogs and other stuff that is following some of the original visions of the web, but have a new language for web applications and anything that requires a stronger security model.
Earlier quoted context omitted.
Our microservices stack is pretty dependent upon clients making cross-origin requests. I don't necessarily consider these "3rd party".
That would mean each call made by the client would require a preflight OPTIONS call. That means extra delay, extra db connections and calls, etc. How do you deal with them?
DB connections are pooled and cached using AWS Lambda.
btw- Our app is a plugin, so origin is always the platform provider... then our app makes CORS calls to AWS.
How do you prevent people proxying your API via a node service? This is something I could never get my head around with CORS - what's the point of whitelisting origins if getting around the whitelist is nothing more than an inconvenience?
To prevent someone abusing your API otherwise, use an authentication method.
This is an awesome overview! But don't take it as all encompassing, it doesn't go into some of the more esoteric edge cases with CORS, like: * either an unreleased safari version, or the most recent version will send preflight requests even if the request meets the spec (like if the Accept-Language is set to something they don't like). * If you use the ReadableStream API with fetch in the browser, a preflight will be…
Genuine question: why do you feel you've cut your teeth more than most? I.e. what kind of dev work do you do that makes you have to deal with this more than the average developer?
Maybe I'm just full of myself though!
Earlier quoted context omitted.
Genuine question: why do you feel you've cut your teeth more than most? I.e. what kind of dev work do you do that makes you have to deal with this more than the average developer?
The main reason is that I've had to re-implement it on the server side 2 times now by sheer "luck", as well as I feel like i've just hit more of the edge cases than most just because of the areas I ended up working in (which just happened to be a handful of canvas-based apps where a couple of them needed to call out to unknown 3rd parties and I had to be very careful about using opaque responses as they would ruin th…
And in no way I meant to imply that you were full of yourself :)
I was just curious as I've only done some front-end dev and dealing with CORS was a minor part of it and I'm always interested in HNers with niche jobs or uncommon experience.
I tend to use jsonp to get out the cors restriction time to time
How do you prevent people proxying your API via a node service? This is something I could never get my head around with CORS - what's the point of whitelisting origins if getting around the whitelist is nothing more than an inconvenience?
If you create a proxy for foo.com, your javascript can't get the browser to send the user's cookies for foo.com to your proxy.
If you're writing an article on CORS today I also think you should mention recent CORS developments such as Cross-Origin Read Blocking (CORB)[2] and features on the horizon such as Cross-Origin-Resource-Policy, Cross-Origin-Window-Policy, etc. that in light of Spectre, Meltdown etc. are meant to help plug speculative execution holes.[3]
[1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
[2]: https://www.chromium.org/Home/chromium-security/corb-for-dev...
I'm ideologically against third party on the web because it is a privacy nightmare. But I'm in the system that I'm in, and I don't take on fights that aren't possible to win, so barring my becoming a billionaire I've kinda just accepted that third party is here for at least a little while and I'm not going to refuse to use ads and analytics. Except on my personal website, that gets to stay cool. That said, CORS is th…
CORS is not necessarily about third parties. It's common to have app.example.org point to a CDN and api.example.org point to an API. And CORS implementation is terrible. The server has to transmit validation rules for the browser to enforce (with vendor specific caching differences), rather than just enforcing access itself. The reason it's implemented this way is because of the organic evolution of web security.