3 ms·
application/x-www-form-urlencoded and multipart/form-data POSTs predate CORS. They have to be whitelisted, or large swaths of the existing web would be broken.
by oefrha 7y ago
application/x-www-form-urlencoded and multipart/form-data POSTs predate CORS. They have to be whitelisted, or large swaths of the existing web would be broken.
- Thorrez 7y agoYes, but that doesn't mean we should build a website that has its CSRF security depend on the Content-Type header. There are other mechanisms to gain this security that are less confusing.
- oefrha 7y agoSure, nothing wrong with an additional (trivial) check, though.
- sroussey 7y agoThese things keep coming up... but how large a swath is it really? Then again, only with TLS 1.3 do we get rid of RC4!! Except when downgrading to 1.2, 1.1, 1.0, ssl3 (is that even around?)
- tialaramex 7y agoYou should not implement SSLv3 If you are willing to do SSLv3 the POODLE attack downgrades you and steals one byte of encrypted data per 256 iterations. If you demand SCSV to defend against this downgrade, every implementation that speaks SCSV also offers a better protocol version than SSLv3 so you won't end up talking SSLv3 anyway, thus you should just not implement SSLv3. You also shouldn't implement RC4 in 2019. Refuse to connect to peers that only offer RC4 instead.
- sroussey 7y agoThat was my point
- oefrha 7y agoTLS version can usually be upgraded transparently by, say, web hosts. To retrofit CORS you actually need to inspect legacy code and sometimes make modifications (in addition to modifying say nginx config), which is a fair bit harder.