Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude's API now supports CORS requests, enabling client-side applications

simonwillison.net

Post reply on HN
Print view View original

51–60 of 173 posts

Re: Claude's API now supports CORS requests, enabling client-side applications

#51

Post by purple-leafy »

vineyardmike wrote: post #45
bboygravity wrote: post #28

Earlier quoted context omitted.

I do the same now for a firefox extension I wrote (automatic form-filler that works way way better than anything else out there). So it's also "bring your own keys" but then how do you monetize at all? I personally don't like "bring your own keys" at all from a user-friendlyness perspective. It means that you exclude the vast majority of potential users, because they don't know what that even means. Even "create an a…

> So it's also "bring your own keys" but then how do you monetize at all? Why do you need to monetize? The original comment you replied to talked about making something for the world and sharing it. They said they didn’t want to maintain it, they didn’t want to be obligated to care for it. You can’t make that choice if people are paying you (or at least shouldn’t…). I don’t understand the BYOx use case for a monetize…

> Why do you need to monetise?

Some people, myself included, are trying to earn a living creating software that helps people in some way. Just like any other physical or digital service, it’s fair to charge for a useful tool

> I don’t understand BYOx use case for monetised product

In my case, BYO keys turns out way cheaper for the end user. For instance my tool calls an LLM API. If I were to host the keys myself, I’d be charged $X for Y calls.

By getting the user to bring their own key, in my case the user easily fits into the free tier of the LLM (Gemini in my case) so the product costs me $0 to run, and I just charge a small service fee for me having created the product.

This allows me to keep building useful tools, some free (7 of 8 projects so far) and some paid (1 of 8)

Re: Claude's API now supports CORS requests, enabling client-side applications

#52

Post by creesch »

TeMPOraL wrote: post #39
creesch wrote: post #19

Earlier quoted context omitted.

Generally speaking that is what OAuth should be used for with clearly defined scopes and insights in what apps are making use of the API through your account. Not an API key with full access and no limitations. With openAI and other providers, I know you can limit the budget for a key, but that is still a pretty broad scope you are left with.

OAuth is nice when you're making an interactive in-browser SaaS. Sucks for just about any other application, in particular anything that may run headless. Thankfully, OpenAI and the like offer actual APIs I can use for software and automation I write. And it is my right, both as a user and a developer, to let someone else write the software I'll use with my keys. It's up to me to decide if I trust that software, and…

Mate, the context is that Claude now supports CORS. We are talking about in-browser use.

Re: Claude's API now supports CORS requests, enabling client-side applications

#53

Post by saagarjha »

Web security noob here. Why does CORS even exist? The fact that a website can’t make a request to another website unless that domain likes it is kind of insane to me. Everyone in the comments here is going on about how maybe the user’s API key gets leaked by a malicious application or whatever but, like, when I write software that isn’t in the browser I can just send a request to anyone without restrictions and as far as I can tell the world has not ended. Why is the browser any different?

Re: Claude's API now supports CORS requests, enabling client-side applications

#55

Post by barrkel »

saagarjha wrote: post #53

Web security noob here. Why does CORS even exist? The fact that a website can’t make a request to another website unless that domain likes it is kind of insane to me. Everyone in the comments here is going on about how maybe the user’s API key gets leaked by a malicious application or whatever but, like, when I write software that isn’t in the browser I can just send a request to anyone without restrictions and as fa…

CORS - or specifically, not permitting cross-origin requests by default - is for preventing CSRF, cross-site request forgery. In particular if the user's credentials (cookies) are passed along with a request to a third party site, then the first party site can act as the user with the user's authority. In other words, evil.com could e.g. send emails on your behalf by making direct requests to your email provider's web interface.

Re: Claude's API now supports CORS requests, enabling client-side applications

#56

Post by tommica »

saagarjha wrote: post #53

Web security noob here. Why does CORS even exist? The fact that a website can’t make a request to another website unless that domain likes it is kind of insane to me. Everyone in the comments here is going on about how maybe the user’s API key gets leaked by a malicious application or whatever but, like, when I write software that isn’t in the browser I can just send a request to anyone without restrictions and as fa…

Simple, if you have an iframe pointing to http://foo.test/deletesite.php, without cors that request will be done, with cookies and everything, without the user being aware of it.

Re: Claude's API now supports CORS requests, enabling client-side applications

#57

Post by eejjjj82 »

saagarjha wrote: post #53

Web security noob here. Why does CORS even exist? The fact that a website can’t make a request to another website unless that domain likes it is kind of insane to me. Everyone in the comments here is going on about how maybe the user’s API key gets leaked by a malicious application or whatever but, like, when I write software that isn’t in the browser I can just send a request to anyone without restrictions and as fa…

CORS is designed to protect the server data. It's a tool that gives servers a control mechanism to tell browsers "who can access my data".

Imagine that your banking website used a standard JSON+REST API with cookie based authentication to trigger & validate a transaction request.

When a request to `fetch` or XMLHTTPRequest is made from ANY site, the browser will still populate cookies for 3rd party sites.

So without CORS, then someone might be able to create a landing page, which in the background triggers a `fetch` or `ajax` request to your bank's transaction endpoint. For 99.999% of people this wouldn't be effective because they are probably not a customer of this bank and are not logged in at the time of the request. But for some very tiny fraction of users, the browser would be tricked into populating the Cookie header from a previously created session in a different tab and would send this request.

The Origin header in the CORS preflight is a signal from the server to the browser that 'yes, this request is safe for you to construct'. This way the browser doesn't let the malicious web page "trick it" in the first place to send the bad request.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

Re: Claude's API now supports CORS requests, enabling client-side applications

#58

Post by EE84M3i »

tommica wrote: post #56
saagarjha wrote: post #53

Web security noob here. Why does CORS even exist? The fact that a website can’t make a request to another website unless that domain likes it is kind of insane to me. Everyone in the comments here is going on about how maybe the user’s API key gets leaked by a malicious application or whatever but, like, when I write software that isn’t in the browser I can just send a request to anyone without restrictions and as fa…

Simple, if you have an iframe pointing to http://foo.test/deletesite.php , without cors that request will be done, with cookies and everything, without the user being aware of it.

AFAIKR you don't need CORS for framing, or making cross origin GET or POST. You only need it to read the response of a cross origin request and setting certain request header and body etc.

For example you can make a cross origin GET with an img tag, and a cross-origin POST with a form tag and some JavaScript.

Re: Claude's API now supports CORS requests, enabling client-side applications

#59

Post by shaneos »

afiodorov wrote: post #10

I love making web apps where users bring their own keys. This approach combines the best of both worlds: the convenience of distributing executable files and the benefits of open source. So far, I have developed two web apps: 1. A live transcription and translation app that uses microphone input. This is useful for watching proprietary content and facilitating communication. 2. An app that translates SRT subtitles in…

I offer both in https://kidzfun.art. If you're non-technical, you can buy packs of 100 images and it uses my key to access Dall-E, or you can provide your own key and pay nothing to me. The vast majority of users go the simpler way, but it's a nice bonus for technical users to just reuse their own key. The difference with your approach is that I store an encrypted copy server side as I do all the AI generation on the server.

Re: Claude's API now supports CORS requests, enabling client-side applications

#60

Post by BrandoElFollito »

saagarjha wrote: post #53

Web security noob here. Why does CORS even exist? The fact that a website can’t make a request to another website unless that domain likes it is kind of insane to me. Everyone in the comments here is going on about how maybe the user’s API key gets leaked by a malicious application or whatever but, like, when I write software that isn’t in the browser I can just send a request to anyone without restrictions and as fa…

There is a good explanation here: https://stackoverflow.com/a/29167709/903011
Post reply on HN