Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Developers don't understand CORS

fosterelli.co

Post reply on HN
Print view View original

361–366 of 366 posts

Re: Developers don't understand CORS

#361

Post by calibas »

Timpy wrote: post #337

> Original security article: briefly touches on CORS > Follow up article: that thing about CORS is not right > Hacker news top level comments: that article's not quite right > First child comments: tlc is also not exactly right I feel like I understand CORS even less now. Article title is right, I don't understand CORS.

I think the issue with understanding CORS is that you first need to understand same-origin policy and exactly when it applies. CORS is simply a method for bypassing same-origin policy. You also need to understand how a CSRF attack works.

Once you grasp both of these things, then you have the base for how and why CORS exists. Until then it's mostly an annoyance.

Re: Developers don't understand CORS

#362

Post by mehrdadn »

anaphor wrote: post #360
mehrdadn wrote: post #359

Earlier quoted context omitted.

It's so stupid. Makes me want to just fork the browsers and add blatantly obvious protections like this if I can find the time...

If you do that, I would recommend looking at writing an extension first to see if there's any way to do it without a fork (maybe using the same technique that things like ublock origin have) https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

Yeah you can almost certainly do it with an extension, but half the point of a fork would be to get the message across that they need to get their act together. (I almost certainly won't get around to it though, so this is just daydreaming.)

Re: Developers don't understand CORS

#363

Post by edejong »

WhitneyLand wrote: post #197
csours wrote: post #12

I certainly don't understand CORS. I've read about it several times and I don't remember what I read. It's like CORS has a teflon coating that prevents it from sticking in my mind. I know what CORS is for and why you need it, but I have no idea how, where, and when to use it.

This Teflon you're talking about, it's a thing. Not just with CORS, not just with you. For example, I've gotten decent at regular expressions a few times but have to keep relearning it. Adding insult to injury, I might relearn something from Stackoverflow, and realize afterwards I posted the answer! Not for trivial stuff. But a string of punctuation with capture groups or whatever, forget about it [1]. Any support fo…

I only just read this comment. It is golden. Now we should just bookmark this comment and use the term teflon tech as often as possible to make it stick (euhm...)

Re: Developers don't understand CORS

#364

Post by james_s_tayler »

recursive wrote: post #291
james_s_tayler wrote: post #266

Earlier quoted context omitted.

Git is amazing, beautiful piece of software. But... sigh I feel exactly how you feel about Git about Vim. It's the one editor everyone has decided despite it's arcane and bizarre UX that you aren't a real programmer if you don't know. Refuse to learn it. Absolutely refuse. I think everyone has one of those things.

I have at least 2. Git and vim. It seems fitting then, that vim should be the default editor for git's commit messages.

Hahahaha. Hot damn. Oh that would really get my goat.

Re: Developers don't understand CORS

#365

Post by icebraining »

falcolas wrote: post #354
icebraining wrote: post #259

Earlier quoted context omitted.

I'm curious, why was it painful? We just had a middleware do an Origin check and copy the header if it matches.

90+ microservices with 5+ environments. Mostly a matter of scaling a solution across a rather large surface area and across a number of languages and teams.

Fair enough; seems like it could be done using a gateway like Kong, but if you're not already using one, it wouldn't be worth adding it just for that.

Re: Developers don't understand CORS

#366

Post by sroussey »

tialaramex wrote: post #320
sroussey wrote: post #301

Earlier quoted context omitted.

These things keep coming up... but how large a swath is it really? Then again, only with TLS 1.3 do we get rid of RC4!! Except when downgrading to 1.2, 1.1, 1.0, ssl3 (is that even around?)

You should not implement SSLv3 If you are willing to do SSLv3 the POODLE attack downgrades you and steals one byte of encrypted data per 256 iterations. If you demand SCSV to defend against this downgrade, every implementation that speaks SCSV also offers a better protocol version than SSLv3 so you won't end up talking SSLv3 anyway, thus you should just not implement SSLv3. You also shouldn't implement RC4 in 2019. R…

That was my point
Post reply on HN