SPAs Are Dead? • Hacker News Board

Re: SPAs Are Dead?

#111

Post by arendtio » Fri, Apr 09, 2021, 7:20 PM UTC

kreetx wrote: post #109

rk06 wrote: post #107

Earlier quoted context omitted.

No, the point of CORS is to mitigate against a security vulnerability in web browsers. All non-browser based app needs no CORS setting

No ;), the point of CORS is to open up the web for cross-origin consumption from the browsers by allowing servers/services to opt in with special headers. Single origin policy is the one that protected against cross-origin requests and is still the default when no CORS is in place.

You are missing the point. You are right about SOP vs. CORS, but the point is, that most clients that are no browsers have no SOP and therefore also don't care about CORS.

So every server, that is not specifically designed to accept connections from browsers, cannot be reached by browser based apps. And that in turn is a serious disadvantage for these apps, because it eliminates a complete class of use-cases.

Yes, if you control both ends you can make it possible, but if you want to build an app that is able to simply connect to any server out there, you will be in trouble.

Re: SPAs Are Dead?

#112

Post by arendtio » Fri, Apr 09, 2021, 7:33 PM UTC

zyemuzu wrote: post #54

kreetx wrote: post #48

Earlier quoted context omitted.

I don't quite get what you mean. If the cross-origin server (to your app) wants to be consumed then it will respond with the correct headers. And if the server is under your control then you can configure it so.

This. I suppose that's what has me confused about both the blog post and comment, i.e. why would you not control your servers?

Because that is actually the classical pattern of applications using the internet ;-) The whole point of internet protocols like HTTP, SMTP and the likes is about not having control over the server and being able to let programs talk to each other anyway.

So if you want to build a classic client app it would be independent from the server implementation. So maybe it would even be 'your' that you would use. For example you could built an app that could talk to a Dropbox server. But with the current SOP setup you would require Dropbox to configure their CORS accordingly.

Re: SPAs Are Dead?

#113

Post by kreetx » Sat, Apr 10, 2021, 7:54 PM UTC

arendtio wrote: post #111

kreetx wrote: post #109

Earlier quoted context omitted.

No ;), the point of CORS is to open up the web for cross-origin consumption from the browsers by allowing servers/services to opt in with special headers. Single origin policy is the one that protected against cross-origin requests and is still the default when no CORS is in place.

You are missing the point. You are right about SOP vs. CORS, but the point is, that most clients that are no browsers have no SOP and therefore also don't care about CORS. So every server, that is not specifically designed to accept connections from browsers, cannot be reached by browser based apps. And that in turn is a serious disadvantage for these apps, because it eliminates a complete class of use-cases. Yes, if…

Let's try to get to the point then!

Any server not configured to reply with permissive CORS headers doesn't want to handle your cross-origin requests. I.e they are not "public areas" for anyone to consume but serve just their own front end.

CORS is a security measure to make it safe to consume cross-origin servers from browsers, both with and without credentials. Otherwise, with credentials you could read client data for some other service. and without credentials you could just use that service's resources without having permission. CORS gives the service operator a method to give permission.

Querying other servers from your back end is another story entirely. CORS isn't required there but also, your server doesn't have access to any of the credentials available in the browser so you wouldn't be able to get any client-specific data. You can get any other data of course, but because this is a server it's easier to block, perhaps by IP or adding captcha.

Re: SPAs Are Dead?

#114

Post by dragonwriter » Sat, Apr 10, 2021, 8:02 PM UTC

arendtio wrote: post #111

kreetx wrote: post #109

Earlier quoted context omitted.

No ;), the point of CORS is to open up the web for cross-origin consumption from the browsers by allowing servers/services to opt in with special headers. Single origin policy is the one that protected against cross-origin requests and is still the default when no CORS is in place.

You are missing the point. You are right about SOP vs. CORS, but the point is, that most clients that are no browsers have no SOP and therefore also don't care about CORS. So every server, that is not specifically designed to accept connections from browsers, cannot be reached by browser based apps. And that in turn is a serious disadvantage for these apps, because it eliminates a complete class of use-cases. Yes, if…

> You are right about SOP vs. CORS, but the point is, that most clients that are no browsers have no SOP and therefore also don't care about CORS.

Clients that aren’t browsers don’t generally have access cookies or similar user credentials for third party services as a result of user interaction with those services that allow exfiltration of data without user intent in the absence of SOP.

SOP is a solution to a browser-specific security issue.

Re: SPAs Are Dead?

#115

Post by arendtio » Sat, Apr 10, 2021, 9:23 PM UTC

dragonwriter wrote: post #114

arendtio wrote: post #111

Earlier quoted context omitted.

You are missing the point. You are right about SOP vs. CORS, but the point is, that most clients that are no browsers have no SOP and therefore also don't care about CORS. So every server, that is not specifically designed to accept connections from browsers, cannot be reached by browser based apps. And that in turn is a serious disadvantage for these apps, because it eliminates a complete class of use-cases. Yes, if…

> You are right about SOP vs. CORS, but the point is, that most clients that are no browsers have no SOP and therefore also don't care about CORS. Clients that aren’t browsers don’t generally have access cookies or similar user credentials for third party services as a result of user interaction with those services that allow exfiltration of data without user intent in the absence of SOP. SOP is a solution to a brows…

> SOP is a solution to a browser-specific security issue.

Indeed, it is, but in my opinion a pretty bad one as it causes a lot of collateral damage. Instead, they should just use the (cookie) state from the origin that initiates the request instead of the origin that receives the request. AFAIK, that should have solved the security issue much more precisely. But now we have to live with the SOP+CORS in the web based world :-/

Re: SPAs Are Dead?

#116

Post by midrus » Sun, Apr 11, 2021, 1:06 PM UTC

wayneftw wrote: post #45

midrus wrote: post #13

Earlier quoted context omitted.

No, it is not. And I hope I never end up using any application developed this way. Tokens stored in those storages you mention can be read by any javascript code, even third party. That doesn't happen with http-only cookies. Be careful with what you recommend publicly, as others might end up assuming this is fine, when it is clearly not.

Meh. Working at a consulting shop I've seen hundreds of apps built with tokens stored in the big bad localStorage. It's easy, it works and if you don't load scripts from untrustworthy sources then there is no attack vector outside of rendering un-sanitized user input as HTML or browser extensions. We've dealt with plenty of security issues and exactly zero of them centered around XSS. I've seen more issues surroundin…

Yep, better to wait until the security issues happen to fix them. Great mentality.

Re: SPAs Are Dead?

#117

Post by midrus » Sun, Apr 11, 2021, 1:07 PM UTC

timw4mail wrote: post #39

midrus wrote: post #13

Earlier quoted context omitted.

No, it is not. And I hope I never end up using any application developed this way. Tokens stored in those storages you mention can be read by any javascript code, even third party. That doesn't happen with http-only cookies. Be careful with what you recommend publicly, as others might end up assuming this is fine, when it is clearly not.

So the article is about being unable to access third-party cookies due to browser privacy updates. 1. If you are using Http-only cookies, these are clearly unrelated. 2. If you are sharing an authentication token with the browser, cookie or not, it can be read by any scripts on the same origin. So...what exactly are you trying to say?

> If you are sharing an authentication token with the browser, cookie or not, it can be read by any scripts on the same origin.

No, it can't. Read about http-only cookies.

Re: SPAs Are Dead?

#118

Post by wayneftw » Mon, Apr 12, 2021, 6:54 PM UTC

midrus wrote: post #116

wayneftw wrote: post #45

Earlier quoted context omitted.

Meh. Working at a consulting shop I've seen hundreds of apps built with tokens stored in the big bad localStorage. It's easy, it works and if you don't load scripts from untrustworthy sources then there is no attack vector outside of rendering un-sanitized user input as HTML or browser extensions. We've dealt with plenty of security issues and exactly zero of them centered around XSS. I've seen more issues surroundin…

Yep, better to wait until the security issues happen to fix them. Great mentality.

I hate to break it to you but that's largely the way the world works.

But, we haven't had any issues with using localStorage. Probably mainly because we are not a huge target. Nobody is going to write a chrome extension to try to hack one of our tiny little sites.