Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Developers don't understand CORS (2019)

fosterelli.co

Post reply on HN
Print view View original

31–40 of 285 posts

Re: Developers don't understand CORS (2019)

#31

Post by oofbey »

ottoflux wrote: post #29

the amount of code i've seen either allowing * when it shouldn't because someone was desperately trying to make their code work is astounding. contractors, "specialists", etc. who never took the time to read how CORS works and how simply you can handle a list of allowable sites, etc. it's only complicated until you take the 5-10 minutes to properly understand what happens where. if you don't know, go do it now.

As somebody who has spent a lot more than 10 minutes trying to figure out why CORS was blocking what seemed legitimate, I sympathize with people doing the wrong thing, and disagree with your assertion that it’s not that complicated. Maybe I’m just slow. But objectively I know I’m not.

Re: Developers don't understand CORS (2019)

#32

Post by N_Lens »

oofbey wrote: post #31
ottoflux wrote: post #29

the amount of code i've seen either allowing * when it shouldn't because someone was desperately trying to make their code work is astounding. contractors, "specialists", etc. who never took the time to read how CORS works and how simply you can handle a list of allowable sites, etc. it's only complicated until you take the 5-10 minutes to properly understand what happens where. if you don't know, go do it now.

As somebody who has spent a lot more than 10 minutes trying to figure out why CORS was blocking what seemed legitimate, I sympathize with people doing the wrong thing, and disagree with your assertion that it’s not that complicated. Maybe I’m just slow. But objectively I know I’m not.

“Objectively”

Re: Developers don't understand CORS (2019)

#34

Post by ctidd »

hn_throwaway_99 wrote: post #28
yaur wrote: post #18

Earlier quoted context omitted.

It’s not that hard to understand… in the cors threat model an attacker gets one your users to take an action on your site by visiting their site.

> in the cors threat model an attacker gets one your users to take an action on your site by visiting their site This is really oversimplifying things, incorrectly IMO, and that sentence makes it sound like you're confusing a CSRF vulnerability with CORS protections. Normally when you write a backend server you implement some sort of authentication and access control, and in that scenario the threat model that lets "…

All CORS does is allow for selective loosening of anti-CSRF controls. CORS is a mechanism for a service to tell a client “I’m CSRF-resistant” so that that the client doesn’t need to protect its user as tightly when interacting with that service.

Re: Developers don't understand CORS (2019)

#35

Post by kartoshechka »

- cors docs are written either from solution or implementation point of view, not the "why this exists, and how we successively deal with bad actors trying to game cors", cors RFC is terse

- protocol itself is quite nuanced, like iirc requests with Authorization (or some other) headers don't obide by usual rules, and again for developer it's just an arbitrary convoluted set of rules, if they don't grasp the problematics

- backend and frontend should work in unison to have correctly configured cors, but as we know, devs hate communicating with each other

Re: Developers don't understand CORS (2019)

#36

Post by supriyo-biswas »

I wish more people read the CORS article on MDN[1] which helped me a lot at the time when I was trying to understand it. I knew some people had trouble with CORS but had no idea it was this bad, going by the comments here.

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/COR...

Re: Developers don't understand CORS (2019)

#37

Post by bornfreddy »

ottoflux wrote: post #29

the amount of code i've seen either allowing * when it shouldn't because someone was desperately trying to make their code work is astounding. contractors, "specialists", etc. who never took the time to read how CORS works and how simply you can handle a list of allowable sites, etc. it's only complicated until you take the 5-10 minutes to properly understand what happens where. if you don't know, go do it now.

5-10 minutes? I'm sold. Any link you can share?

I'm saying this as someone who has learned about CORS protections many times, implemented the solutions with care they deserved, but forgot most of it soon after - each time. So I'd be very happy to invest even 15 minutes to break this cycle.

Re: Developers don't understand CORS (2019)

#38

Post by ozim »

Issue is that for most projects CORS is set and forget. You don’t run into it once a month or even once a year - you run into it when setting up new project from scratch.

Many or most developers work on existing projects that have all kinds of security defaults set somewhere in the past and no one bothers reviewing those.

Re: Developers don't understand CORS (2019)

#39

Post by muvlon »

Even TFA seemingly doesn't understand CORS. Or at least misreprents it grossly:

> The webserver listening in on localhost:19421 should implement a REST API and set a Access-Control-Allow-Origin header with the value https://zoom.us. This will ensure that only Javascript running on the zoom.us domain can talk to the localhost webserver.

No, that does not do that. JavaScript from any other website can still talk to localhost:19421 just the same. CORS doesn't restrict anything, it loosens the default set of restrictions (ignoring preflight requests for now and assuming we're talking just about "safe" Methods). That Access-Control-Allow-Origin header just allows JavaScript running on zoom.us to read the responses when it queries localhost:19421. The requests happen in any case, and you must ensure in your backend that they don't cause any adverse effects.

Re: Developers don't understand CORS (2019)

#40

Post by mparnisari »

I'm one of them. CORS is THE topic that I have to get a refresher for periodically. It's like I forget about it, it never sticks. I'm a backend developer so I never encounter any cors issues. Maybe that's why? I seem to forget things that I don't use on a day to day basis, so.
Post reply on HN