CORS is not meant to secure an API endpoint
nikofischer.com
CORS is not meant to secure an API endpoint
1–10 of 162 posts
Re: CORS is not meant to secure an API endpoint
#2What is missing is a guide how to replace the bad pattern bey a good one.
Add a function that the user can login, create his individual API key, and store in a a secure way on his client (e.g. any credential store)
Re: CORS is not meant to secure an API endpoint
#3Even this article gets it wrong: CORS does not protect you in any way. It‘s a relaxation of the SOP! Thus it decreases security.
Re: CORS is not meant to secure an API endpoint
#4I do like it when Google API or someone pings you when that's publicly committed although it's usually on purpose/you limit the referrer.
The CORS thing is funny, I like seeing the scans people do on your servers like .env or some php script
Re: CORS is not meant to secure an API endpoint
#5Even this article gets it wrong: CORS does not protect you in any way. It‘s a relaxation of the SOP! Thus it decreases security.
(SOP = same origin policy: https://en.wikipedia.org/wiki/Same-origin_policy.)
Re: CORS is not meant to secure an API endpoint
#6What is missing is a guide how to replace the bad pattern bey a good one. Add a function that the user can login, create his individual API key, and store in a a secure way on his client (e.g. any credential store)
httpOnly secure same-site cookie.
Even storing a session token in localStorage is not a problem if you‘re protected against xss (if your not, nothing else will protect you anyway)
Re: CORS is not meant to secure an API endpoint
#7What is missing is a guide how to replace the bad pattern bey a good one. Add a function that the user can login, create his individual API key, and store in a a secure way on his client (e.g. any credential store)
httpOnly secure same-site cookie. Even storing a session token in localStorage is not a problem if you‘re protected against xss (if your not, nothing else will protect you anyway)
That last argument you're making there is not valid in my opinion. Security is built by layers and the reason we use HttpOnly cookies is to still have protection even if malicious javascript steals a cookie.
Re: CORS is not meant to secure an API endpoint
#8Earlier quoted context omitted.
httpOnly secure same-site cookie. Even storing a session token in localStorage is not a problem if you‘re protected against xss (if your not, nothing else will protect you anyway)
That last argument you're making there is not valid in my opinion. Security is built by layers and the reason we use HttpOnly cookies is to still have protection even if malicious javascript steals a cookie.
How does it protect the user? If there is a XSS vulnerability I can do anything in your name anyways. Stealing the cookie is not necessary.
Re: CORS is not meant to secure an API endpoint
#9CORS is confusing to understand because the kind of attack it protects against is confusing.
CORS does not protect endpoints against malicious clients, since you can always just make the same request outside of a browser. And it doesn't protect any site from making or receiving cross-site requests, since CORS can always be disabled on the server side.
CORS protect against the scenario where a malicious site tricks an unmodified browser to make a cross-site request to a legitimate site. If the user has an authentication cookie for the legitimate site, the cookies will be sent along with the request. So the malicious site can perform transactions in the legitimate site on behalf of the user, despite not having direct access to the authentication cookie.
CORS is further complicated because certain forms of cross-site requests have always been allowed by browsers, and therefore must remain enabled by default for backwards compatibility. GET requests to separate sites is allowed, since this has always been allowed e.g. to embed images from other domains. POST requests are allowed with the caveat that you can't inspect the result, because you have always been able to initiate a post to a different site from a html form.
Re: CORS is not meant to secure an API endpoint
#10Am I right in thinking that storing secrets/API keys in cloud functions is OK though. i.e. CF cloud workers or similar