3 ms·
I’m not sure CORS has failed. It’s forced a lot of teams to put internal apis on the same host, which is a security win.
by blowski 4y ago
I’m not sure CORS has failed. It’s forced a lot of teams to put internal apis on the same host, which is a security win.
- capableweb 4y agoYeah, either putting the content + backend behind the same Origin, or just add `Access-Control-Allow-Origin: *` as a header to all requests (and the other ones), which one you think is most popular for people with no time to build things properly? ;)
- P5fRxh5kUvp2th 4y agoI agree with you, but there are those of us who push for putting everything behind the same origin and we succeed in that because most people are aware of how painful CORS is. So, in some ways, CORS being so painful is actually helping (tongue-in-cheek, but it has some truth to it).
- blowski 4y agoWith CORS we can choose from: 1. Apply more specific security appropriate for your use case 2. Put it on the same host 3. Origin *. Teams that do this probably have bigger security problems anyway. Without CORS, we'd all be stuck choosing between 2 and 3.