3 ms·
I understood your comment to say they should do CORS properly, which amounts to just magic strings sent back to a potential attacker. HMAC is separate from COR
by revelation 10y ago
I understood your comment to say they should do CORS properly, which amounts to just magic strings sent back to a potential attacker.
HMAC is separate from CORS, or did I miss something?
- agency 10y agoI think I'm confused myself. I was interpreting the main issue in the JetBrains case to be their use of very permissive CORS headers on the locally running server, but their solution added an auth token in addition to removing the CORS policies. ycmd also doesn't appear to set any CORS headers, in addition to validating the HMAC of the request. Is a sane cross-origin policy not enough on its own to prevent evil.com from being able to communicate with a web server running on localhost? Or is the message authentication to protect from attack vectors other than the user navigating to a malicious site?
- revelation 10y agoCORS seems like a nice-to-have. You're relying on other software to always indicate something is a cross origin request, browsers should always do that but then there is a whole host of software that uses embedded web controls and the like and may navigate to webpages on the basis of external and not user input.