4 ms·

What the article completely ignores, is the fact, that building cross site apps has been next to impossible for a long time. Since you can't contact a server wh

What the article completely ignores, is the fact, that building cross site apps has been next to impossible for a long time. Since you can't contact a server who doesn't explicitly allows connections via CORS, your browser based app doomed. And I write this as someone who would love to build apps all day with web technologies.

kreetx 6y ago
I don't quite get what you mean. If the cross-origin server (to your app) wants to be consumed then it will respond with the correct headers. And if the server is under your control then you can configure it so.
- zyemuzu 6y ago
  This. I suppose that's what has me confused about both the blog post and comment, i.e. why would you not control your servers?
  - kreetx 6y ago
    Not entirely sure what parent meant but it seems that many web developers are still confused as to why they can't consume any site on the internet from the front end.
  - arendtio 6y ago
    Because that is actually the classical pattern of applications using the internet ;-) The whole point of internet protocols like HTTP, SMTP and the likes is about not having control over the server and being able to let programs talk to each other anyway. So if you want to build a classic client app it would be independent from the server implementation. So maybe it would even be 'your' that you would use. For example you could built an app that could talk to a Dropbox server. But with the current SOP setup you would require Dropbox to configure their CORS accordingly.
- arendtio 6y ago
  For non-browser apps the server doesn't have to explicitly allow it. A simple curl can access any server it wants. If y browser based apps wants to access another server, that server needs to be configured to allow it (because of the Same Origin Policy) and how many servers do you know that allow anybody to access them via CORS? So take for example a WebDAV server. In theory, you could build a web based app, that can access any WebDAV server out there on the internet. In practice, that WebDAV server requires a special CORS configuration in order to be accessible via a browser from a different origin. Any other normal desktop app doesn't care about CORS and can access any server it has credentials for, no matter what configuration it has.
  - Cederfjard 6y ago
    Not all apps need to contact third-party servers, so the way you categorically claim that building cross site web apps is next to impossible seems a bit exaggerated? Edit: Unless you don’t consider it ”cross site” if you control the API server?
  - kreetx 6y ago
    I would think any service that wants to be consumed will have CORS configured? All else should be forbidden, that is the whole point of CORS.
    - rk06 6y ago
      No, the point of CORS is to mitigate against a security vulnerability in web browsers. All non-browser based app needs no CORS setting
      - kreetx 6y ago
        No ;), the point of CORS is to open up the web for cross-origin consumption from the browsers by allowing servers/services to opt in with special headers. Single origin policy is the one that protected against cross-origin requests and is still the default when no CORS is in place.

kreetx 6y ago

I don't quite get what you mean. If the cross-origin server (to your app) wants to be consumed then it will respond with the correct headers. And if the server is under your control then you can configure it so.

zyemuzu 6y ago
This. I suppose that's what has me confused about both the blog post and comment, i.e. why would you not control your servers?
- kreetx 6y ago
  Not entirely sure what parent meant but it seems that many web developers are still confused as to why they can't consume any site on the internet from the front end.
- arendtio 6y ago
  Because that is actually the classical pattern of applications using the internet ;-) The whole point of internet protocols like HTTP, SMTP and the likes is about not having control over the server and being able to let programs talk to each other anyway. So if you want to build a classic client app it would be independent from the server implementation. So maybe it would even be 'your' that you would use. For example you could built an app that could talk to a Dropbox server. But with the current SOP setup you would require Dropbox to configure their CORS accordingly.
arendtio 6y ago
For non-browser apps the server doesn't have to explicitly allow it. A simple curl can access any server it wants. If y browser based apps wants to access another server, that server needs to be configured to allow it (because of the Same Origin Policy) and how many servers do you know that allow anybody to access them via CORS? So take for example a WebDAV server. In theory, you could build a web based app, that can access any WebDAV server out there on the internet. In practice, that WebDAV server requires a special CORS configuration in order to be accessible via a browser from a different origin. Any other normal desktop app doesn't care about CORS and can access any server it has credentials for, no matter what configuration it has.
- Cederfjard 6y ago
  Not all apps need to contact third-party servers, so the way you categorically claim that building cross site web apps is next to impossible seems a bit exaggerated? Edit: Unless you don’t consider it ”cross site” if you control the API server?
- kreetx 6y ago
  I would think any service that wants to be consumed will have CORS configured? All else should be forbidden, that is the whole point of CORS.
  - rk06 6y ago
    No, the point of CORS is to mitigate against a security vulnerability in web browsers. All non-browser based app needs no CORS setting
    - kreetx 6y ago
      No ;), the point of CORS is to open up the web for cross-origin consumption from the browsers by allowing servers/services to opt in with special headers. Single origin policy is the one that protected against cross-origin requests and is still the default when no CORS is in place.