4 ms·
The article mentions the SameSite stuff early on, then kinda mentions it in passing when it comes to CORS + credentials "The same-site rules around cookies stil
by jaffathecake 5y ago
The article mentions the SameSite stuff early on, then kinda mentions it in passing when it comes to CORS + credentials "The same-site rules around cookies still apply, as do the kinds of isolation we see in Firefox and Safari. But these only come into effect cross-site, not cross-origin".
Seems like I need to word it better though.
- Steltek 5y agoIs it fair to say that the strongest CORS request allows the weakest? That is, if your server supports a preflighted, credentialed, cached CORS request with weird headers and methods, then it would support just about anything? Perhaps a detailed walkthrough of that one specific scenario, which would enable almost all others, would be helpful.
- jaffathecake 5y agoYeah, the most permissive CORS allows everything, although it's kinda risky to do if you don't understand the consequences.
- ufmace 5y agoI don't think that's very accurate generally - the CORS Access-Control headers are pretty flexible, and can be locked down to only allow the specific weird thing you want to do. The part where that is kind of true is setting cookies with SameSite=None - it's needed for the CORS credentials to work, but it might cause security issues with other uses of your website.