3 ms·
I don't get it. What's wrong with normal CORS? They do work for private networks. Also I don't think browsers are the right place to do this kind of protection.
by janci 6y ago
I don't get it. What's wrong with normal CORS? They do work for private networks. Also I don't think browsers are the right place to do this kind of protection.
- cratermoon 6y agoIt says right there in the proposal > status quo CORS protections don’t protect against the kinds of attacks discussed here as they rely only on CORS-safelisted methods and CORS-safelisted request-headers. No preflight is triggered, and the attacker doesn’t actually care about reading the response, as the request itself is the CSRF attack.
- zeroimpl 6y agoBut what about those vulnerabilities is specific to being on a private network? If we can find a public website with the same vulnerability, will we start enforcing stricter CORS requirements everywhere?
- janci 6y agoOk, this will protect old unpatched vulnerable devices. But what will prevent a negligent manufacturer that uses HTTP GET without CSFR protection to apply configuration to the device from just adding the CORS opt-in header everywhere? I mean it would be the simplest solution for them.