8 ms·
Does it enforce Cross-Origin Policies? Since the addresses are just path components and not subdomains this may be an issue. It's just a feeling this might ge
by ysleepy 9y ago
Does it enforce Cross-Origin Policies?
Since the addresses are just path components and not subdomains this may be an issue.
It's just a feeling this might get relevant, especially with PUT/POST write API and so on. Even just running on localhost might pose issues.
- StavrosK 9y agoDoes what enforce it? The browser does, that's why you need to set CORS on your local node for it to work. What's the scenario you're thinking of?
- eriknstr 9y agoSo in order for this to work through a gateway, that gateway needs to set the CORS headers, or?
- jstanley 9y agoNo because you'll be fetching it from the gateway, and then writing to the same gateway. No cross-domain going on.
- eriknstr 9y agoBut then is it not a security problem that other IPFS apps retrieved through the same gateway will be seen by the browser as being of same origin?
- jstanley 9y agoYes, for now. There is code existing to set the Suborigin header, but browser support is limited, and I'm not even sure if that code is merged into mainline IPFS yet.
- ysleepy 9y agoDifferent authors and documents are considered part of the same domain since the tokens are just path elements. The whole IPFS gateway might be considered one big domain. So javascript in an essay can access/put the API. I didn't really look into it too much, just wanted to give a pointer that this might need to be considered. In the sense that it might have security implications.
- StavrosK 9y agoNo, you're right in this, if you have it enabled, any app can put stuff to your endpoint. The people of IPFS are working on fixing this problem, but I personally think that the risk is low enough. Maybe I'm just not creative enough in thinking about attacks, though.