Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Developers don't understand CORS (2019)

fosterelli.co

Post reply on HN
Print view View original

101–110 of 285 posts

Re: Developers don't understand CORS (2019)

#101

Post by 9dev »

koolala wrote: post #98
9dev wrote: post #75

Earlier quoted context omitted.

> If you want to do anything interesting […] you have to run your own browser This is usually a sign you don't really understand what you're doing.

Its not? Remember the 90s? There was a beautiful time before CORS and DRM in the browser. Browsers used to be something that actually cared about allowing full client control.

But it isn't the 90s anymore. Billions of people are using the internet, doing everything from voting to shopping to managing their stock portfolio. There are valid reasons why we have security protocols.

And aside from that - it's not like CORS is preventing you from anything. The only requirement is to read up on it, understand it, and configure your web server accordingly. If you're unable to do that, or you'd rather create your own browser, then the only conclusion I can draw is that you're either unwilling or unable to take proper care of the security of your users.

Re: Developers don't understand CORS (2019)

#102

Post by kaoD »

ivanjermakov wrote: post #72
robertclaus wrote: post #11

I bet there's an awful lot of servers out there that will happily take CORS requests from any host because someone didn't understand why their second domain couldn't talk to the same API.

Sometimes it's a good thing when I try to use someone else's backend in my web app. For example map tile server or route builder, which are session-less and have no authentication. The idea that HTTP servers are restricted to requests from a single domain by default is strange, wonder if CORS world be better off opt-in rather than opt-out.

> wonder if CORS world be better off opt-in rather than opt-out.

It's necessary that the defaults are secure. More so, not less, if the problem is hard.

Re: Developers don't understand CORS (2019)

#103

Post by sureglymop »

bazoom42 wrote: post #70
zdc1 wrote: post #57

Earlier quoted context omitted.

Even the HN comments here are a sea of confusion and contradiction. It's stunning and makes me wonder whether CORS is a bad solution, or if it's solving a hard problem.

CORS is counter intuitive. I don’t think there is a better way to solve the problem, it is just a difficult to understand problem. CORS errors occur when JavaScript in the browser attempts to call a server which is not configured to allow it. But the check is purely client-side. You can circumvent it entirely by using curl or whatever outside the browser. For example the server sends a header indicating which domains…

Could you go the full mile and explain that very specific kind of attack?

Re: Developers don't understand CORS (2019)

#104

Post by koolala »

inigyou wrote: post #87
stephbook wrote: post #21

I still don't understand the threat model and, obviously, it's not explained here either. I log in to social.net. I click on scam.org and change sites. I'm on scam.org and it triggers a request to social.net/friends. No cookies are sent, no JWT. I'm not logged in and get a "Needs login" HTTP error. Nothing bad happens. I thought that's how it works without CORS already.

Your cookies are sent.

Then why wasn't credentialless a simple fix to solve that. Not sending cookies isn't hard.

Re: Developers don't understand CORS (2019)

#106

Post by koolala »

9dev wrote: post #101
koolala wrote: post #98

Earlier quoted context omitted.

Its not? Remember the 90s? There was a beautiful time before CORS and DRM in the browser. Browsers used to be something that actually cared about allowing full client control.

But it isn't the 90s anymore. Billions of people are using the internet, doing everything from voting to shopping to managing their stock portfolio. There are valid reasons why we have security protocols. And aside from that - it's not like CORS is preventing you from anything. The only requirement is to read up on it, understand it, and configure your web server accordingly. If you're unable to do that, or you'd rat…

I don't care about my server. It has everything to do with what it is preventing my browser client from doing. The whole point is using content from the whole web not my server.

Re: Developers don't understand CORS (2019)

#108

Post by [deleted] »

koolala wrote: post #98
9dev wrote: post #75

Earlier quoted context omitted.

> If you want to do anything interesting […] you have to run your own browser This is usually a sign you don't really understand what you're doing.

Its not? Remember the 90s? There was a beautiful time before CORS and DRM in the browser. Browsers used to be something that actually cared about allowing full client control.

[deleted]

Re: Developers don't understand CORS (2019)

#109

Post by moring »

ameliaquining wrote: post #9
deathanatos wrote: post #3

Earlier quoted context omitted.

> by design the error messages sent to the browser are intentionally gutted A CORS error is not "an error message sent to the browser", it is an error generated by the browser, because the browser has decided it cannot permit the request. (Though certainly a server can not understand a CORS request as such, and returned a weird response, which would then end up getting translated to a CORS failure.)

I think what the person you're replying to is trying to say is that the web-accessible error message (i.e., the one that JavaScript running in the sending page can read) is intentionally opaque and somewhat misleading, because a more helpful error message would leak information about the response that the sending origin isn't supposed to have. There's typically a more helpful error message in the dev tools (which Jav…

The message in the dev tools is, at least for Chrome, extremely developer unfriendly: The blocked request is displayed in a very strange way, without any information that it was blocked, nor that CORS was the reason for it, nor how that decision was made based on the preflight request.

You have to already know from experience that these strange devoid-of-information requests have been blocked by CORS, then find the preflight request, and there you will find a bit more information, but still much less than would be possible to show.

Showing more information would, AFAIK, not circumvent the layer of security that CORS (or actually origin isolation, which CORS makes an exemption from) adds. My best guess is that this just had very low priority when building the dev tools.

Re: Developers don't understand CORS (2019)

#110

Post by theginger »

Cors is hard to understand because the browser is protecting you and the server from malicious code that the developers are not expecting to be there. Its a hypothetical threat you cannot see during development unless you really go out of your way. If you can't see the threat it's hard to understand it, it you don't understand the threat it's hard to understand the protection against it.

Its one of those situations where you need to think like an attacker to see the whole picture.

Post reply on HN