4 ms·

I think the edge compute trend is cycling developers away from CORS again. The old server-rendered frameworks (rails, django) never really needed CORS because

I think the edge compute trend is cycling developers away from CORS again. The old server-rendered frameworks (rails, django) never really needed CORS because frontend and backend were on the same origin. Then lots of CORS issues cropped up when we started putting React frontends on a separate subdomain from the backend. But these days, frontend and backend are being pushed onto the same origin again by running compute (or a reverse proxy) at the edge. Next.js is a good example that has baked this practice into the framework itself.

dexwiz 6y ago
For small sized apps this may be true. For enterprise apps where multiple teams develop multiple features that all end up the same domain, this is still very much an issue. Many enterprise apps need to talk to more than one backend, and you end up with inexperienced developers trying to call remote services from client side code. Or the reverse where you get reqs to create a public api which is basically a proxy for an external service. From what I can tell, it hits marketers the hardest. They want to be able to drop tracking code everywhere and get frustrated when third party services don’t have * for an allow list and they can’t put analytics in code that is ultimately hosted and ran from a vendors server.