6 ms·
As webapp developers, does recommending our users to enable it give any meaningful protection for our website if we don't don't set Access-Control-Allow-Origin
by espadrine 9y ago
As webapp developers, does recommending our users to enable it give any meaningful protection for our website if we don't don't set Access-Control-Allow-Origin (or only set it to a star)?
- Ajedi32 9y ago> don't set Access-Control-Allow-Origin (or only set it to a star) Huh? These are two _very_ different situations. Not setting `Access-Control-Allow-Origin` would mean that no third party site can read data from your domain. Setting it to `*` would do the exact opposite, allowing any site to read data on the page. It's also unclear to me how this relates to Spectre and Meltdown.
- espadrine 9y agoThe Site Isolation page[0] states: > This protection is made possible by the following changes in Chrome's behavior: > […] > - Cross-site "documents" (specifically HTML, XML, and JSON files) are not delivered to a web page's process unless the server says it should be allowed (using CORS). I understand it to mean that the tab's process used to hold code that verified the CORS header, and that the verification is now out-of-process. [0]: http://www.chromium.org/Home/chromium-security/site-isolation http://www.chromium.org/Home/chromium-security/site-isolatio...
- floil 9y agoSetting it to star allows arbitrary cross origin access (star means 'any site' in this context). Omitting it is supposed to be the opposite. Important not to confuse the two! Enabling site per process in chrome will give your users some protection of their data on your site, but only if your mime types are already correct. See the probably linked document for recommended headers.