Developers don't understand CORS

#1

Post by chrisfosterelli » Wed, Jul 10, 2019, 6:01 PM UTC

Developers don't understand CORS
fosterelli.co

Re: Developers don't understand CORS

#2

Post by jonstaab » Wed, Jul 10, 2019, 6:20 PM UTC

Totally agree. Something about CORS and the resources out there makes newcomers think that it's something the client has to do differently. I thought this when first doing cross-origin stuff, and thought it was just me until my dad (programmer for 30 years) got stuck on it the exact same way.

Also, the author makes a good point that `Access-Control-Allow-Origin: *` is pretty dangerous. I hadn't really worried about it in the past, because "I don't care who calls my api, they aren't authenticated". But if malicious client code got a hold of a user's session (using XSS or what have you), I'd be open to them steering my user's session and doing horrible things. Definitely going to review my current projects with this in mind.

Edit: of course, if I have an XSS vulnerability, they'd be able to do that from my domain anyway, so CORS doesn't 100% fix the problem. XSS is bad.

Re: Developers don't understand CORS

#3

Post by corey_moncure » Wed, Jul 10, 2019, 6:27 PM UTC

jonstaab wrote: post #2

Totally agree. Something about CORS and the resources out there makes newcomers think that it's something the client has to do differently. I thought this when first doing cross-origin stuff, and thought it was just me until my dad (programmer for 30 years) got stuck on it the exact same way. Also, the author makes a good point that `Access-Control-Allow-Origin: *` is pretty dangerous. I hadn't really worried about i…

I for sure haven't mastered CORS.

What would you use instead of that? Suppose you're doing something like client-side Blazor that calls to a WebAPI project. How can you improve security by restricting the origin of access requests when your client is open to the public?

Re: Developers don't understand CORS

#4

Post by jonstaab » Wed, Jul 10, 2019, 6:34 PM UTC

corey_moncure wrote: post #3

jonstaab wrote: post #2

Totally agree. Something about CORS and the resources out there makes newcomers think that it's something the client has to do differently. I thought this when first doing cross-origin stuff, and thought it was just me until my dad (programmer for 30 years) got stuck on it the exact same way. Also, the author makes a good point that `Access-Control-Allow-Origin: *` is pretty dangerous. I hadn't really worried about i…

I for sure haven't mastered CORS. What would you use instead of that? Suppose you're doing something like client-side Blazor that calls to a WebAPI project. How can you improve security by restricting the origin of access requests when your client is open to the public?

I'm not familiar with Blazor or WebAPI, but if you're not expecting requests from client-side javascript specifically, you can just use `Access-Control-Allow-Origin: null`, since non-browser clients don't respect CORS anyway.

If by "open to the public" you mean "open to requests from any client domain", CORS isn't going to help. In that case I'd probably have api clients pre-register a whitelist of domains that they're planning to make client-side requests from, so you can check the domain against the whitelist and dyanamically build your allow-origin header.

Re: Developers don't understand CORS

#5

Post by rmbryan » Wed, Jul 10, 2019, 6:35 PM UTC

Maybe we don't understand CORS.

Here's a fact-based starting point to learn about CORS: https://en.wikipedia.org/wiki/Cross-origin_resource_sharing

Re: Developers don't understand CORS

#6

Post by phkahler » Wed, Jul 10, 2019, 6:36 PM UTC

Not a web dev. Can anyone tell me what CORS is ultimately used for? Not the literal technical details, the higher level what does it enable sites to do? And is that for them or their visiters?

Re: Developers don't understand CORS

#7

Post by mehrdadn » Wed, Jul 10, 2019, 6:39 PM UTC

jonstaab wrote: post #2

Totally agree. Something about CORS and the resources out there makes newcomers think that it's something the client has to do differently. I thought this when first doing cross-origin stuff, and thought it was just me until my dad (programmer for 30 years) got stuck on it the exact same way. Also, the author makes a good point that `Access-Control-Allow-Origin: *` is pretty dangerous. I hadn't really worried about i…

Could you give a realistic example where it wouldn't lead you to have a bigger problem on your hands? I think that'd be extremely helpful.

Re: Developers don't understand CORS

#8

Post by arve0 » Wed, Jul 10, 2019, 6:41 PM UTC

Zoom does not need CORS-headers to fix the vulnerability, rather make the web server running on localhost drop requests with wrong origin header.

Re: Developers don't understand CORS

#9

Post by dillonmckay » Wed, Jul 10, 2019, 6:41 PM UTC

phkahler wrote: post #6

Not a web dev. Can anyone tell me what CORS is ultimately used for? Not the literal technical details, the higher level what does it enable sites to do? And is that for them or their visiters?

So, javascript requests made from one site to another would be allowed/prevented from returning the information to the browser session.

It can still be abused to exfiltrate data.

Re: Developers don't understand CORS

#10

Post by MetalGuru » Wed, Jul 10, 2019, 6:42 PM UTC

> The webserver listening in on localhost:19421 should implement a REST API

Is this server started by Zoom? In order to implement an endpoint, they’d have to ship a server along with the client. And this server would always be running? Is this not overkill for such a small feature (being able to click a link)