51–54 of 54 posts
Earlier quoted context omitted.
Another symptom of how rotten the javascript ecosystem is. If I'm picking a technology stack for a business, I want to pick one that will last me 10 years.
Good luck with your Java Web Start app!
Earlier quoted context omitted.
The diagram is bad, the browser is running code loaded on app.* and making requests to api.*; I've used similar setups and have run into the same issues the author is describing.
How did you end up dealing with them?
Earlier quoted context omitted.
I'm not sure I follow. If you can use it from curl (presumably by passing the client certificate) couldn't you also use it from a browser? The browser has client certificate infrastructure, surely it can use it when making ajax requests?
You can, it just requires you to import the cert and use some pretty gnarly UI. I didn't mean to imply you couldn't use it from the browser, just that it was much less likely than curl + we rely on the cert for figuring out your account and not an API key.
I personally always thought that the CORS domain checking was needlessly and overly restrictive. I can understand entirely different top-level domains; definitely 100% necessary. You start to lose me at different sub-domains for the same top-level domain. Do we really need to check api.example.com from app.example.com ? Chances are good that they're both controlled by the same entity, so what's the problem? I'm out t…