3 ms·

Author here! I don't know if you read the article, but it includes the history and reason behind CORS. It definitely protects more than nothing :)

• lloydatkinson 5y ago
  I had a quick scan yeah. I'm sure historically it does but I've yet to ever need or encounter anyone that makes use of these features. I've never been in a team that particularly cares about any of it's supposed value either, it's merely a frustration to remove...
  • jaffathecake 5y ago
    You should try out some connected home devices, including things like routers. Like I said in the article, many of them assume they're safe because they're on a local network, so their security is lax. Also, I know quite a few public sites that serve debugging data if the request comes from the company's IP range. They shouldn't be doing this, but they do. Maybe one day we can remove CORS for no-credential requests if we can detect that the destination isn't "internal", and we just decide that folks who serve debugging data by IP deserve to have their data leak. I've heard ideas around this for 10 years now, but maybe it'll happen eventually.
  • johncolanduoni 5y ago
    Did any of your teams put private data into HTML or JSON responses authenticated with a cookie, but which didn’t require anything like a CSRF header? If so they should have cared about it because without CORS policies any user logged into your site could have their data read by any other site they visited.
    • lloydatkinson 5y ago
      Oh it's turned on, but it always only boils down to "turn it totally off" or "here is the whitelist". Such a lacking tool.