5 ms·

I think the concern is for even clicking a link, which to my knowledge typically hasn't fallen under implicit CORS concerns. The browser will automatically ass

I think the concern is for even clicking a link, which to my knowledge typically hasn't fallen under implicit CORS concerns. The browser will automatically assume that unless a private origin server (i.e. one within a private address space) explicitly allows requests from a public source, then the navigation should be prevented. It's always a challenge in browser design, but basically this is just another case of killing valid use cases because some servers don't follow the spec (i.e. GETs with side effects).

londons_explore 5y ago
> killing valid use cases because some servers don't follow the spec There are probably 25 IoT devices in my home, and more than half of them have a magic GET request with side effects. For example, just by clicking this link, my lights turn on http://lighting.londons_explorer/cm?POWER%20ON http://lighting.londons_explorer/cm?POWER%20ON A malicious web page could redirect me to that URL and force my lights on with no input from me. I bet some of the devices allow firmware updates with the same method.
- rStar 5y ago
  that’s your home. i don’t choose to buy bs iot devices(i mean do you have kids? if you do this is borderline neglect, all their(your hypothetical children) stuff is all over the internet most likely), so this problem doesn’t affect me in the same way.
- tommek4077 5y ago
  And because you use crap hardware, everyone else has to change his totally legitimate network setup?
  - lillecarl 5y ago
    I don't think it's because of this one person, but rather the masses that has crap hardware and software installed everywhere. It's a global problem, not everyone is capable of securing their own network.
    - bawolff 5y ago
      Although i agree with this browser change, i highly doubt it will fix all crap hardware. There's a limit to how much you can apply band aid solutions to something that seems to be trying its hardest to be insecure, and non-idempotent GET requests is a bit beyond a minor oversight.
      - rocqua 5y ago
        Note that GET requests should be side-effect free. Not just idempotent. That means a GET request that turns your lights on, or opens your garage door (which is idempotent) is still wrong.
        bawolff 5y ago
        Isn't that what idempotent means? You can't exactly open the garage if its already open. https://developer.mozilla.org/en-US/docs/Glossary/Idempotent https://developer.mozilla.org/en-US/docs/Glossary/Idempotent
        marmight 5y ago
        In general, an idempotent method is a method such that calling it one time is the same as calling it n times in a row for any n > 1. However, idempotency doesn't require that calling the method one time is the same as calling it zero times, although such a method isn't excluded from the definition either. So a stateless method is necessarily idempotent, but an idempotent method isn't necessarily stateless.
        vel0city 5y ago
        From your example: > DELETE /idX/delete HTTP/1.1 is idempotent, even if the returned status code may change between requests: So requesting to open the garage door multiple times which results in an open garage door in the end is an idempotent request, even though after the second request the response is "I am already open!" Now, a request to toggle the state of the garage door would not be idempotent. The state of the system is different if you call it an odd or even amount of times.
  - kalleboo 5y ago
    I'd wager the ratio of people who have at least one item of IoT junk to the number of people who have a legit setup that requires allowing cross site access to a local resource from a remote one is probably ten million to one. Who are these "everyone else" who are controlling their LAN devices from a public website who are going to suffer an evening setting up CORS? edit: what I can see breaking is stuff like Synology QuickConnect https://global.download.synology.com/download/Document/Software/WhitePaper/Firmware/DSM/All/enu/Synology_QuickConnect_White_Paper.pdf https://global.download.synology.com/download/Document/Softw...
    - johnchristopher 5y ago
      > edit: what I can see breaking is stuff like Synology QuickConnect https://global.download.synology.com/download/Document/Softw https://global.download.synology.com/download/Document/Softw... Goooooood. I hate this thing with a passion since I had to set it up for a computer illiterate friend.
    - vetinari 5y ago
      Also services using split horizon DNS: i.e. it is publicly available service, but only when used from outside. When used from inside, it is not routed through public interface, but resolved directly to it's internal IP.
      - wink 5y ago
        I'm pretty sure I'm lacking experience in administering a huge network to spot the obvious? problem, but for smaller setups I've never understood why you would do this anyway and not treat it as "external first" by putting it in a sort of DMZ and treat your internal users as "quasi-external" ones by routing them into the DMZ via another means... Of course this has the downside if you have actual 'internal only' stuff, but those could be separated from the split stuff... Just too much work with years (decades) old setups?
        vetinari 5y ago
        In DMZ, it still has an IP from private range, ergo, still treated as internal -- it doesn't matter whether it is in the same subnet as your users, only whether it falls into the range that the browser considers private. So it doesn't solve anything here.
- dotancohen 5y ago
  > just by clicking this link, my lights turn on Wasn't working for me, so I added an entry to my hosts file directing it to 127.0.0.1. Now I don't know what's happening with _your_ lights, but when I click that link my own lights come on.
  - chessmango 5y ago
    No idea why this obvious joke was downvoted tbh :P
    - randombits0 5y ago
      A dress-up localhome joke? Hey, at least it was one I hadn’t heard. (Cracked a localhome joke in for my first IT job interview. Manager laughed, Engineering Manager rolled his eyes.)
- eesmith 5y ago
  Couldn't a malicious page use an IMG URL to issue the GET request, as in <img src="http://lighting.londons_explorer/cm?POWER%20ON http://lighting.londons_explorer/cm?POWER%20ON">?
  - londons_explore 5y ago
    Yes
    - eesmith 5y ago
      Wee! I think I'll add that to my repo so you'll know when you're looking at my code. :)

londons_explore 5y ago

> killing valid use cases because some servers don't follow the spec There are probably 25 IoT devices in my home, and more than half of them have a magic GET request with side effects. For example, just by clicking this link, my lights turn on http://lighting.londons_explorer/cm?POWER%20ON http://lighting.londons_explorer/cm?POWER%20ON A malicious web page could redirect me to that URL and force my lights on with no input from me. I bet some of the devices allow firmware updates with the same method.

rStar 5y ago
that’s your home. i don’t choose to buy bs iot devices(i mean do you have kids? if you do this is borderline neglect, all their(your hypothetical children) stuff is all over the internet most likely), so this problem doesn’t affect me in the same way.
tommek4077 5y ago
And because you use crap hardware, everyone else has to change his totally legitimate network setup?
- lillecarl 5y ago
  I don't think it's because of this one person, but rather the masses that has crap hardware and software installed everywhere. It's a global problem, not everyone is capable of securing their own network.
  - bawolff 5y ago
    Although i agree with this browser change, i highly doubt it will fix all crap hardware. There's a limit to how much you can apply band aid solutions to something that seems to be trying its hardest to be insecure, and non-idempotent GET requests is a bit beyond a minor oversight.
    - rocqua 5y ago
      Note that GET requests should be side-effect free. Not just idempotent. That means a GET request that turns your lights on, or opens your garage door (which is idempotent) is still wrong.
      - bawolff 5y ago
        Isn't that what idempotent means? You can't exactly open the garage if its already open. https://developer.mozilla.org/en-US/docs/Glossary/Idempotent https://developer.mozilla.org/en-US/docs/Glossary/Idempotent
        marmight 5y ago
        In general, an idempotent method is a method such that calling it one time is the same as calling it n times in a row for any n > 1. However, idempotency doesn't require that calling the method one time is the same as calling it zero times, although such a method isn't excluded from the definition either. So a stateless method is necessarily idempotent, but an idempotent method isn't necessarily stateless.
        vel0city 5y ago
        From your example: > DELETE /idX/delete HTTP/1.1 is idempotent, even if the returned status code may change between requests: So requesting to open the garage door multiple times which results in an open garage door in the end is an idempotent request, even though after the second request the response is "I am already open!" Now, a request to toggle the state of the garage door would not be idempotent. The state of the system is different if you call it an odd or even amount of times.
- kalleboo 5y ago
  I'd wager the ratio of people who have at least one item of IoT junk to the number of people who have a legit setup that requires allowing cross site access to a local resource from a remote one is probably ten million to one. Who are these "everyone else" who are controlling their LAN devices from a public website who are going to suffer an evening setting up CORS? edit: what I can see breaking is stuff like Synology QuickConnect https://global.download.synology.com/download/Document/Software/WhitePaper/Firmware/DSM/All/enu/Synology_QuickConnect_White_Paper.pdf https://global.download.synology.com/download/Document/Softw...
  - johnchristopher 5y ago
    > edit: what I can see breaking is stuff like Synology QuickConnect https://global.download.synology.com/download/Document/Softw https://global.download.synology.com/download/Document/Softw... Goooooood. I hate this thing with a passion since I had to set it up for a computer illiterate friend.
  - vetinari 5y ago
    Also services using split horizon DNS: i.e. it is publicly available service, but only when used from outside. When used from inside, it is not routed through public interface, but resolved directly to it's internal IP.
    - wink 5y ago
      I'm pretty sure I'm lacking experience in administering a huge network to spot the obvious? problem, but for smaller setups I've never understood why you would do this anyway and not treat it as "external first" by putting it in a sort of DMZ and treat your internal users as "quasi-external" ones by routing them into the DMZ via another means... Of course this has the downside if you have actual 'internal only' stuff, but those could be separated from the split stuff... Just too much work with years (decades) old setups?
      - vetinari 5y ago
        In DMZ, it still has an IP from private range, ergo, still treated as internal -- it doesn't matter whether it is in the same subnet as your users, only whether it falls into the range that the browser considers private. So it doesn't solve anything here.
dotancohen 5y ago
> just by clicking this link, my lights turn on Wasn't working for me, so I added an entry to my hosts file directing it to 127.0.0.1. Now I don't know what's happening with _your_ lights, but when I click that link my own lights come on.
- chessmango 5y ago
  No idea why this obvious joke was downvoted tbh :P
  - randombits0 5y ago
    A dress-up localhome joke? Hey, at least it was one I hadn’t heard. (Cracked a localhome joke in for my first IT job interview. Manager laughed, Engineering Manager rolled his eyes.)
eesmith 5y ago
Couldn't a malicious page use an IMG URL to issue the GET request, as in <img src="http://lighting.londons_explorer/cm?POWER%20ON http://lighting.londons_explorer/cm?POWER%20ON">?
- londons_explore 5y ago
  Yes
  - eesmith 5y ago
    Wee! I think I'll add that to my repo so you'll know when you're looking at my code. :)