3 ms·
They tried to propose a simple modern solution but after reading the article it does not look simple and works much worse than traditional approach with tokens.
by codedokode 9y ago
They tried to propose a simple modern solution but after reading the article it does not look simple and works much worse than traditional approach with tokens.
And of course it would be better if browsers would not make cross-origin requests unless permitted by server.
- wearhere 9y agoHi @codedokode, I'm one of the authors of the post. There's a lot of background material at the top but if you skip to the use of our new module (direct link: https://github.com/mixmaxhq/cors-gate/#usage https://github.com/mixmaxhq/cors-gate/#usage) I think you'll find it simpler in both code and infrastructure than a typical CSRF setup. https://github.com/expressjs/csurf https://github.com/expressjs/csurf, for instance, requires you to lock down every API both server-side and client-side, and by default requires session middleware; whereas with cors-gate you can register it once, server-side, before any API routes.