3 ms·
> "Access-Control-Allow-Origin" doesn't block the request from going through, it just prevents wrong-origin Javascript from accessing the response." On a GET r
by ChrisCinelli 7y ago
> "Access-Control-Allow-Origin" doesn't block the request from going through, it just prevents wrong-origin Javascript from accessing the response."
On a GET request (like the one generated by a IMG tag) and all the other cases that do not require a pre-flight request ( https://www.w3.org/TR/cors/#preflight-request https://www.w3.org/TR/cors/#preflight-request ) this is correct.
Are we clear on the thread model and what Zoom is trying to do? As far as I know, Zoom wants to make "joining a meeting" as easy as clicking a link. I do not think Zoom wants people to be logged in a zoom account in order to join.
And what Zoom should try to avoid is to have random people joining meetings and website forcing actions on the laptop of the people.
A simple fix is to use a GUID or any other long not-guessable string for the meeting id. And, of course, do not expose any other potentially dangerous endpoints beside the one that starts the meeting.
In general it should not be about either CORS or CSRF. There are better ways to start a video call communicating with a plugin than exposing a port on localhost and using <img src="localhost:12345/a-command?aParameter=12345" /> to communicate with it.
- kortilla 7y agoI’m not sure you understand the threat model either. Even if the meeting ID is a GUID, you’re still leaving an avenue for people to have their visitors join arbitrary meetings.
- ChrisCinelli 7y agoWell, I guess I need to explicitly say that having the Zoom client asking something like: "www.visited-site.com" wants to start a meeting with you. Do you want to join? is (uncommon?) common sense that the Zoom app should follow.
- TazeTSchnitzel 7y agoThey seem to have engineered this just to avoid such a prompt, because Safari brings up one when navigating to a protocol that launches an external app.
- Thorrez 7y agoThe threat model seems to have 2 requirements: 1. Only if the top level url bar says zoom.us is it allowed to cause any noticeable change to the zoom native app. This means some arbitrary website cannot cause any noticeable change to the zoom native app without redirecting you to zoom.us . This also means that a sandboxed iframe, such as an embedded web ad, has no possible way to cause a noticeable change to the zoom native app, because it is not able to do top level navigation to zoom.us . 2. When the zoom native app is triggered, the user must click yes on a confirmation button before joining the meeting. I don't see people advocating that you need to be logged in to zoom.us . Achieving requirement 1 without requirement 2 is still bad, because some website could redirect to zoom.us and force you into a meeting. Achieving requirement 2 without requirement 1 is not too bad, but is annoying, because some sandboxed ad in a website could cause the zoom native app to pop up, annoying you, and could maybe almost be a DOS.
- deleted 7y ago[deleted]