331–340 of 366 posts
Earlier quoted context omitted.
application/x-www-form-urlencoded and multipart/form-data POSTs predate CORS. They have to be whitelisted, or large swaths of the existing web would be broken.
Yes, but that doesn't mean we should build a website that has its CSRF security depend on the Content-Type header. There are other mechanisms to gain this security that are less confusing.
That's just my opinion on it.
Earlier quoted context omitted.
The advice is wrong. Someone could follow the advice in the article and still be vulnerable. The article should mention the actual vulnerability: CSRF, because there's a state-changing HTTP handler with no CSRF protection. CORS doesn't automatically protect against CSRF, and people shouldn't be given that impression.
I've been seeing more and more developers not being aware about CSRF. Maybe the reason is that frameworks got very good built in support for CSRF protection, which caused CSRF vulnerabilities to be less common, which lead to OWASP to remove it from #8 on the list in 2013 to to not be explicitly on the top 10 at all in 2017. (marked as "Merged or retired, but not forgotten"): https://www.owasp.org/images/7/72/OWASP_To…
Oh the irony.
Setting up some local shizzle on production server that is callable from frontend ... Just stop, you can have microservices that listen on local interface but please call it from behind api gateway. If you have some different domains you need to use then yeah make subdomains? I don't know just hire some Ops people and make them work together with Devs.
Earlier quoted context omitted.
>> I wonder if there is any way I can use an image element to bypass CORS and read RSS xml that way !? The article in question says they used the image dimensions to encode the error codes returned by the server when making a request. I can imagine you could simply encode the payload in the dimensions of the image.
I was thinking about using img.src to replace xmlReq and Fetch. So that I can fetch sites that I do not own. eg. RSS feeds.
> Follow up article: that thing about CORS is not right
> Hacker news top level comments: that article's not quite right
> First child comments: tlc is also not exactly right
I feel like I understand CORS even less now. Article title is right, I don't understand CORS.
Earlier quoted context omitted.
>There's only a state-changing GET handler because they chose to work around CORS and you can't POST for images. I'm not sure of that. There's tons of stuff in existence that has state changing GET handlers that don't have the goal of working around CORS, check out the HN upvote button. It's conceivable to me that if Zoom managed to send a CORS response header, they might have used an XHR with GET (considering GET is…
State-changing GET handlers are against the HTTP concept and specs and are trouble waiting to happen. Each and every one of them were designed and implemented by incompetent and/or inexperienced developers.
;-)