4 ms·

CORS is a stupid idea that serves no purpose. If someone is really determined they will either 1) turn off CORS with a browser extension 2) simply call your pre

CORS is a stupid idea that serves no purpose. If someone is really determined they will either 1) turn off CORS with a browser extension 2) simply call your precious API from something other than an a browser It is essentially security by obscurity and protects nothing. Don't get me started how some technologies like AWS Lambda with a Gateway, when a function has an error, responds by default in such a way it makes the browser log a CORS error instead of, you know, a 500 or the actual error message. I always do the "allow anything" setting for CORS when I make an API.

fraktl 5y ago
Out of curiosity, how come you dared to make this comment without ensuring you've got all your facts straight? No, it isn't security through obscurity. Yes, it protects and it protects a lot. Thank you for contributing to lack of knowledge, do keep up.
- lloydatkinson 5y ago
  You're welcome
jaffathecake 5y ago
Author here! I don't know if you read the article, but it includes the history and reason behind CORS. It definitely protects more than nothing :)
- lloydatkinson 5y ago
  I had a quick scan yeah. I'm sure historically it does but I've yet to ever need or encounter anyone that makes use of these features. I've never been in a team that particularly cares about any of it's supposed value either, it's merely a frustration to remove...
  - jaffathecake 5y ago
    You should try out some connected home devices, including things like routers. Like I said in the article, many of them assume they're safe because they're on a local network, so their security is lax. Also, I know quite a few public sites that serve debugging data if the request comes from the company's IP range. They shouldn't be doing this, but they do. Maybe one day we can remove CORS for no-credential requests if we can detect that the destination isn't "internal", and we just decide that folks who serve debugging data by IP deserve to have their data leak. I've heard ideas around this for 10 years now, but maybe it'll happen eventually.
  - johncolanduoni 5y ago
    Did any of your teams put private data into HTML or JSON responses authenticated with a cookie, but which didn’t require anything like a CSRF header? If so they should have cared about it because without CORS policies any user logged into your site could have their data read by any other site they visited.
    - lloydatkinson 5y ago
      Oh it's turned on, but it always only boils down to "turn it totally off" or "here is the whitelist". Such a lacking tool.
lol768 5y ago
> CORS is a stupid idea that serves no purpose. If someone is really determined they will either 1) turn off CORS with a browser extension 2) simply call your precious API from something other than an a browser > It is essentially security by obscurity and protects nothing. What. I think there's been a fundamental misunderstanding of who is being protected here on your part, and what CORS is actually for. It's your run-of-the-mill user that CORS protects, and CORS being enforced protects them when they visit e.g. an attacker-controlled site with, for example, a valid cookie-based session on your service. It prevents the attacker's site from making dangerous authenticated requests to your API service and reading the result. > If someone is really determined they will either 1) turn off CORS with a browser extension 2) simply call your precious API from something other than an a browser That's not what CORS is designed to protect against at all, of course you can hit an API separately and your HTTP client will ignore the CORS headers. Your HTTP client isn't a browser! It doesn't need to worry about CORS. Similarly, users shooting themselves in the foot by disabling CORS are only hurting themselves. They are not the attacker here.
- deleted 5y ago
  [deleted]
- Randosaurus 5y ago
  Nowadays you can set cookie flags to ensure those sorts of attacks don't happen.
lucideer 5y ago
Being an engineer who doesn't understand CORS is ok; I've worked with a few good ones who struggled with it, so clearly CORS is not a very intuitive tech. Not understanding CORS and making a comment like this is taking that ignorance to a new level though. Please read up on what you're talking about.
- lloydatkinson 5y ago
  Please tell me more about how publically accessible by anyone REST API's need CORS. Are you actually suggesting people have to tell companies what domains they will be calling an API from, in order to add it to the list of allowed domains, in the code base?
  - lucideer 5y ago
    Does your publicly accessible API provide contextual information based on client-state? It probably doesn't, in which case you're right, CORS isn't needed, and lo and behold, this is exactly what the Origin wildcard is for. Adding it isn't a big deal. But no, it's not really a great idea to make every single privileged API in the world completely insecure just so the admins of public APIs can avoid adding a wildcard header to their servers.
  - hbn 5y ago
    > Please tell me more about how publically accessible by anyone REST API's need CORS It's not security for the provider of the API, it's security for the user of a web browser

fraktl 5y ago

Out of curiosity, how come you dared to make this comment without ensuring you've got all your facts straight? No, it isn't security through obscurity. Yes, it protects and it protects a lot. Thank you for contributing to lack of knowledge, do keep up.

lloydatkinson 5y ago
You're welcome

jaffathecake 5y ago

Author here! I don't know if you read the article, but it includes the history and reason behind CORS. It definitely protects more than nothing :)

lloydatkinson 5y ago
I had a quick scan yeah. I'm sure historically it does but I've yet to ever need or encounter anyone that makes use of these features. I've never been in a team that particularly cares about any of it's supposed value either, it's merely a frustration to remove...
- jaffathecake 5y ago
  You should try out some connected home devices, including things like routers. Like I said in the article, many of them assume they're safe because they're on a local network, so their security is lax. Also, I know quite a few public sites that serve debugging data if the request comes from the company's IP range. They shouldn't be doing this, but they do. Maybe one day we can remove CORS for no-credential requests if we can detect that the destination isn't "internal", and we just decide that folks who serve debugging data by IP deserve to have their data leak. I've heard ideas around this for 10 years now, but maybe it'll happen eventually.
- johncolanduoni 5y ago
  Did any of your teams put private data into HTML or JSON responses authenticated with a cookie, but which didn’t require anything like a CSRF header? If so they should have cared about it because without CORS policies any user logged into your site could have their data read by any other site they visited.
  - lloydatkinson 5y ago
    Oh it's turned on, but it always only boils down to "turn it totally off" or "here is the whitelist". Such a lacking tool.

lol768 5y ago

> CORS is a stupid idea that serves no purpose. If someone is really determined they will either 1) turn off CORS with a browser extension 2) simply call your precious API from something other than an a browser > It is essentially security by obscurity and protects nothing. What. I think there's been a fundamental misunderstanding of who is being protected here on your part, and what CORS is actually for. It's your run-of-the-mill user that CORS protects, and CORS being enforced protects them when they visit e.g. an attacker-controlled site with, for example, a valid cookie-based session on your service. It prevents the attacker's site from making dangerous authenticated requests to your API service and reading the result. > If someone is really determined they will either 1) turn off CORS with a browser extension 2) simply call your precious API from something other than an a browser That's not what CORS is designed to protect against at all, of course you can hit an API separately and your HTTP client will ignore the CORS headers. Your HTTP client isn't a browser! It doesn't need to worry about CORS. Similarly, users shooting themselves in the foot by disabling CORS are only hurting themselves. They are not the attacker here.

deleted 5y ago
[deleted]
Randosaurus 5y ago
Nowadays you can set cookie flags to ensure those sorts of attacks don't happen.

lucideer 5y ago

Being an engineer who doesn't understand CORS is ok; I've worked with a few good ones who struggled with it, so clearly CORS is not a very intuitive tech. Not understanding CORS and making a comment like this is taking that ignorance to a new level though. Please read up on what you're talking about.

lloydatkinson 5y ago
Please tell me more about how publically accessible by anyone REST API's need CORS. Are you actually suggesting people have to tell companies what domains they will be calling an API from, in order to add it to the list of allowed domains, in the code base?
- lucideer 5y ago
  Does your publicly accessible API provide contextual information based on client-state? It probably doesn't, in which case you're right, CORS isn't needed, and lo and behold, this is exactly what the Origin wildcard is for. Adding it isn't a big deal. But no, it's not really a great idea to make every single privileged API in the world completely insecure just so the admins of public APIs can avoid adding a wildcard header to their servers.
- hbn 5y ago
  > Please tell me more about how publically accessible by anyone REST API's need CORS It's not security for the provider of the API, it's security for the user of a web browser