3 ms·
I hope, some day to actually understand CORS. What it does. Why it exists. What good does it do. It seems extremely weird to me that my web page cannot get a si
by perryizgr8 6y ago
I hope, some day to actually understand CORS. What it does. Why it exists. What good does it do. It seems extremely weird to me that my web page cannot get a simple json file from my GCP VM which is just serving that file and nothing else.
- user5994461 6y agoLet's say you're logged in to facebook. Without CORS any site you visit in your browser could send a javascript request to facebook.com/postmessage, posting messages as yourself without your knowledge or consent ;) That's a problem, so browser block cross site requests (CORS) by default.
- anderspitman 6y agoThe problem with cross-origin requests as I understand it essentially boils down to cookies. If cross-origin requests weren't blocked by default, any site you visit could send requests to your bank, for example. Since those requests would send auth cookies, they could potentially make changes to your bank account. So these requests are disabled by browsers unless the bank explicitly tells them (via CORS headers) that it's ok. IMO the better way to handle it is by allowing cross-origin requests, but locking down cookies so they aren't sent cross-domain by default (ie by setting SameSite on cookies). For my services I generally open CORS up, but only implement authenticated requests with API tokens. The main problem is if you set a custom header (such as Authorization: Bearer) it triggers a preflight request. The only reasonable way I know around this is sending the token in the query parameters, but that also introduces some security issues.