3 ms·
> And CORS implementation is terrible. The server has to transmit validation rules for the browser to enforce (with vendor specific caching differences), rather
by Ajedi32 8y ago
> And CORS implementation is terrible. The server has to transmit validation rules for the browser to enforce (with vendor specific caching differences), rather than just enforcing access itself.
I disagree. The current model where the server has to opt-in to cross origin access by explicitly sending an Access-Control-Allow-Origin header is secure-by-default, whereas a model relying on the server to enforce access would be insecure-unless-the-server-properly-checks-the-origin-header, leading to all sorts of vulnerabilities.
- paulddraper 8y agoIt's already insecure-unless-the-server-checks-the-cookie-header.
- ec109685 8y agoSomething servers already do.
- biot 8y agoIt’s secure in a “trust the client” manner. Any server code not still doing its own authentication is in for a rude awakening.
- ec109685 8y agoIf you don’t trust the client, there is nothing you can do. An insecure browser could spoof the origin header too.
- biot 8y agoI think you’re missing my point. While you can assume well behaved clients will reduce unwanted traffic, a malicious client will spoof everything it can. Thus, there is definitely something you can do: you should never trust the client and the server should authenticate every request (as if CORS didn’t exist) instead of assuming all requests from clients are valid.