81–90 of 128 posts
Earlier quoted context omitted.
Yeah, when Web fonts rolled around we fought that battle again and won. Some important people saw the light :-). (And to be fair, CORS was more widely available on servers.)
I think font foundries were particularly keen on that juicy Origin header so they could tell who was using their font, and block sites that hadn't paid.
Earlier quoted context omitted.
Hey Jake, would love to see this topic discussed in HTTP 203!
We've got an episode on Deno https://www.youtube.com/watch?v=SYkzk_j3yb0&list=PLNYkxOF6rc... , and another which covers cross-origin fetches https://www.youtube.com/watch?v=vfAHa5GBLio&list=PLNYkxOF6rc... (although it isn't CORS specific), or did you mean something more specific?
I just want to easily let my users make API requests to an API whose CORS settings don't allow it. Instead I have to tell my users to give me their API key so I can make the request from my server. Or I'd have to tell them to run a program that makes the requests.
Both options suck for non-technical users.
I wish there was a way to let me make POST requests on behalf of the user without dealing with CORS. Of course the request wouldn't include any user cookies etc to avoid the security issues. I just want to easily let my users make API requests to an API whose CORS settings don't allow it. Instead I have to tell my users to give me their API key so I can make the request from my server. Or I'd have to tell them to run…
You can! And it can include credentials!
You can do this with a basic element, so fetch() lets you do the same. What you can't do is read the response.
Demo: https://jakearchibald.com/2021/cors/playground/?prefillForm=...
How to win at CORS: Don't use it. Just put the apis you need on the same domain, use a reverse proxy. Same-site just works, always.
This. But hey, with so many impostors around - they're not capable of fathoming how golden this advice is. Sad truth is, since "developers" don't use this, they genuinely don't understand browsers and HTTP and that's what 's dangerous.
The lead prosecutor, Erin Nealy Cox, then took a job with the firm that leads Boeing's criminal defense.
When developing a webapp these days, I use a local proxy. This allows me to type a staging/production URL into Chrome, and get the frontend and the backend from either my local machine or staging/prod. I can mix and match any combination by checking/unchecking a box in Proxyman. This means there is no need to whitelist localhost for CORS, and other hoops. Another advantage is that you're experiencing the app with SSL…
When developing a webapp these days, I use a local proxy. This allows me to type a staging/production URL into Chrome, and get the frontend and the backend from either my local machine or staging/prod. I can mix and match any combination by checking/unchecking a box in Proxyman. This means there is no need to whitelist localhost for CORS, and other hoops. Another advantage is that you're experiencing the app with SSL…
I tried to achieve the same thing in the past and have run across issues with HSTS. The details are escaping me but I think it might have been that when using the production app without a proxy, the SSL certificate was associated with the HSTS records in the browser and when I switched to a proxy, the HSTS started failing because the certificate has changed. Have you run into this at all? How have you solved it?