4 ms·
How to win at CORS: Don't use it. Just put the apis you need on the same domain, use a reverse proxy. Same-site just works, always.
by nhumrich 5y ago
How to win at CORS:
Don't use it. Just put the apis you need on the same domain, use a reverse proxy. Same-site just works, always.
- jaffathecake 5y agoDon't do this with third party APIs though! It's even riskier than adding a third party script.
- nhumrich 5y agoWhy?
- humbleMouse 5y agoExactly, the whole concept of CORS is just a security issue waiting to happen. Especially these days with all these cloud systems having 14 network layers that all ignore certain headers and add other ones.
- locallost 5y agoMy colleagues and I came to the same conclusion some time ago. I think CORS is not that complicated in essence, but I don't need to deal with it often enough to really memorize all the details. And there are many, as the article shows. Somehow we were always able to in the end deal with it, but at one point we didn't want to anymore. You make all these plans on how this service should be service.example.com and that one service2.example.com and this kind of feels like building something, but in reality it's just a headache unless you really need to do this for some reason.
- fraktl 5y agoThis. But hey, with so many impostors around - they're not capable of fathoming how golden this advice is. Sad truth is, since "developers" don't use this, they genuinely don't understand browsers and HTTP and that's what 's dangerous.
- blacktriangle 5y agoThis is just not an option for so many very legitimate use cases. Building client-side apps that aggregate and display information from multiple web services hosting on domains totally outside of my control is valuable.
- nhumrich 5y agoYes, but in those cases, you aren't the one worrying about cors. The services you use are.