3 ms·
Are you able to elaborate further on what attack vector you're thinking of (if only so I can google it) - JSON hijacking maybe? The implicit assumption being t
by yomly 8y ago
Are you able to elaborate further on what attack vector you're thinking of (if only so I can google it) - JSON hijacking maybe?
The implicit assumption being that internally everything trusts the proxy?
- graystevens 8y agoI believe they are referring to proxying requests to third parties, rather than the first part of the post which refers to proxying to your own backend. Proxying requests to a third-party will mean browser security features like CORS will assume they are entirely safe due to them appearing to come from your domain, and not “gist.github.com” etc.