4 ms·
Being an engineer who doesn't understand CORS is ok; I've worked with a few good ones who struggled with it, so clearly CORS is not a very intuitive tech. Not
by lucideer 5y ago
Being an engineer who doesn't understand CORS is ok; I've worked with a few good ones who struggled with it, so clearly CORS is not a very intuitive tech.
Not understanding CORS and making a comment like this is taking that ignorance to a new level though. Please read up on what you're talking about.
- lloydatkinson 5y agoPlease tell me more about how publically accessible by anyone REST API's need CORS. Are you actually suggesting people have to tell companies what domains they will be calling an API from, in order to add it to the list of allowed domains, in the code base?
- lucideer 5y agoDoes your publicly accessible API provide contextual information based on client-state? It probably doesn't, in which case you're right, CORS isn't needed, and lo and behold, this is exactly what the Origin wildcard is for. Adding it isn't a big deal. But no, it's not really a great idea to make every single privileged API in the world completely insecure just so the admins of public APIs can avoid adding a wildcard header to their servers.
- hbn 5y ago> Please tell me more about how publically accessible by anyone REST API's need CORS It's not security for the provider of the API, it's security for the user of a web browser