4 ms·
I know the official line is that CORS “protects” the relying party (the website that initiates requests) but in practice I have found it to be quite the opposit
by EGreg 5y ago
I know the official line is that CORS “protects” the relying party (the website that initiates requests) but in practice I have found it to be quite the opposite.
From having to deal with CORS over the years, to me is just a tool to protect one thing… the intellectual property of whatever site we are loading resources from.
For example, images arrive “tainted” and you can’t get their pixels on a canvas no matter how hard you try. You can’t generate a “screenshot” you can print, and so forth.
If this was just about protecting the relying party website, that website would have a way to get around this “protection” to get something done.
Sure, people can try to get at the intellectual property directly, but they’d have to have an authenticated account first. If they do it on the site where it’s hosted, they are subject to its rules. If they are coming from some random site, eg loading it in bulk, the resulting info they get can’t be analyzed by the Javascript.
Yes CORS is just a relaxation of SOP, which makes it impossible to get sensitive data that would have otherwise been revealed to the relying party. Again — SOP is protecting the user’s data loaded from the ORIGIN. Its main job is’t “protecting the receiving site”, that’s a pretty disingenuous characterization.
- marcosdumay 5y agoHum... I've never seen this use-case, but CORS and SOP are implemented on the browser under total control of the end user. If you create a scraping tool, you are perfectly capable of replacing it with any policy you want. (Besides, I'm not sure where it falls inside the new Firefox extension rules, but this is the kind of thing to implement on an extension, or in the worst case, on a plugin.)
- JanSt 5y agoCORS does not protect the website at all…
- TheCoelacanth 5y ago> I know the official line is that CORS “protects” the relying party (the website that initiates requests) You're getting that wrong. It doesn't protect the website that initiates the requests. It protects the user from the website initiating the requests. SOP is to stop website A from doing shady things to the user using their session from website B. It does protect you in the sense that protecting your users is also protecting you, but it requires voluntary cooperation from the user, so it doesn't do anything to protect you from malicious users. In the "hotlinking" example you're giving, CORS is only protection from the absolute laziest of attackers, since you can get around that with about 5 minutes of setting up nginx to proxy from your domain to the resources you want to re-use. You can also get the same protection without CORS by blocking requests based on the Referer header