6 ms·
CORS is such an ugly web standard. It's not only a pain in you butt, but it also makes your requests slow through these extra pre-flight round-trips. I have h
by toomim 5y ago
CORS is such an ugly web standard. It's not only a pain in you butt, but it also makes your requests slow through these extra pre-flight round-trips.
I have hope that we can remove it, though, in new versions of HTTP.
CORS only exists because XMLHTTPRequest broke the assumptions of web 1.0 servers. Suddenly any web browser loading any page anywhere could make a request to your server without the user's explicit permission, and a ton of web servers had already been built and were running under the assumption that users would only hit their endpoints by explicitly typing in a URL or clicking on a link.
But each time we design a new version of HTTP, we get an opportunity to remove CORS restrictions for it, because there aren't any servers running the new version yet.
And with Braid (https://braid.org https://braid.org), we're making changes that are big enough that I think it really warrants taking a fresh look at all of this stuff. So I have hope that we can eliminate CORS and all this ugliness.
- rfraile 5y agoInstead of sending a request before every defined case in the CORS policy, it could be implemented requesting only one GET to a plain file (fully cacheable) with the domain policy definition. Like robots.txt for the search engines.
- dmw_ng 5y agoThis is how Macromedia Flash handled it a lifetime ago
- moralestapia 5y agoFlash was 20 years ahead of its time (even though it already had its share of fame). Apple killed it to pave way for the App Store. It was a shame because around that time Flash was at its peak of innovation, with stuff like Alchemy (whose modern day equivalent could be WebAssembly) and Flex (no-code thingy that was TRULY catching up, only 10 years ago). It was also starting to implement features like atomics, shared data buffers, app bundles, hardware-accelerated 3D, etc... They also went to great lenghts to open their VM, and the ecosystem that was being generated around that was awesome (anyone here used haXe back then?). It was also present on like 99% of devices already and it was the only thing at the time that truly felt like "write once, run anywhere" (HTML wasn't as feature-rich and still quite fragmented between browsers). Flash was the single biggest threat to Apple's planned business model, and with it gone, Apple's road to becoming a trillion-dollar company has been a walk in the park.
- deleted 5y ago[deleted]
- orf 5y agoExcept CORS policies can be dynamic, depending on the request context.
- ryanbrunner 5y agoIt doesn't seem impossible that the static file could have an indicator for "send an OPTIONS in this case". 95% of CORS setups don't need to look at the request beyond the origin requesting it (and I'd wager that almost all CORS-enabled APIs just blindly allow everything).
- cma 5y agoCross-Origin Resource Sharing (CORS)
- thaumasiotes 5y ago> CORS only exists because XMLHTTPRequest broke the assumptions of web 1.0 servers. Suddenly any web browser loading any page anywhere could make a request to your server without the user's explicit permission This had always been true; making cross-origin requests with e.g. <img> tags is still very much a thing.
- colinclerk 5y agoThis is why we can make GET and POST requests without an OPTIONS preflight... Apparently, since developers should already have been protecting against cross-origin requests on GET and POST via other means (CSRF tokens), there was no need for the additional preflight protection. They only added preflights to requests that browsers couldn't make previously. Source: https://stackoverflow.com/a/39736697/114855 https://stackoverflow.com/a/39736697/114855
- Raqbit 5y agoThis is also the reason you can still POST text/plain to random TCP servers on the user's local network, without pre-flight check.
- dividuum 5y agoThat’ll be gone soon: https://web.dev/cors-rfc1918-feedback/ https://web.dev/cors-rfc1918-feedback/
- matsemann 5y agoI'd rather deal with stateless CORS than having to muck around with CSRF again, though.
- jrochkind1 5y agoTrue. CORS exists because the web browser would send the user's cookies (ie auth) for your site to you, when the user doesn't think they are on your site, but it's really malicious code from another site the user was visiting, acting as the user on your site without the user's knowledge. Thats the threat model CORS is meant to address. Not just in general that a web host might not want a request from "anywhere" happening, but that site B might not want an authenticated request on behalf of User X to site B being made by code from site A.
- wolf550e 5y agoBesides loading resources which was mentioned by sibling comment, some websites still rely on submiting forms cross origin, even with cookies! XMLHTTPRequest is not required. iframes exist, so the user doesn't even have to see their browser make those requests.
- fraktl 5y agoNo, it's not ugly. It's necessary. And we don't need any additional tooling around it or yet another thing that "fixes" what doesn't need to be fixed. If you control domain.com and api.domain.com, then you can create a proxy that glues the two to the same domain, getting rid of any CORS annoyances forever. And you use the tech that exists. The whole problem takes less than 1 minute to type, test, deploy and there's no need for yet another big thing invented to solve a small problem that occurs due to ignorance of self-proclaimed "developers".
- pineconewarrior 5y agoI think it has some ugliness to it, but the idea behind it is necessary. The restrictions it places on front-end scripts are currently very challenging to work around, particularly if you're trying to implement a strict CORS policy on an existing website. It's difficult enough to implement that it probably won't be implemented on the majority of the web - and maybe that's okay.
- andyp-kw 5y agoYes it is ugly. How many learners have been stumpped by CORS errors over the years? But it's also necessary.
- rattlesnakedave 5y ago> And we don't need any additional tooling around it or yet another thing that "fixes" what doesn't need to be fixed This is what CORS is though.
- foobarbecue 5y agoWhat is braid? I just get a blank page.
- canadaduane 5y agoTry loading again, seems to be working now. Braid is an IETF draft proposal (and larger ecosystem) around bringing state synchronization to HTTP.