3 ms·
> it didn't take incoming requests from anything except the bank's internal physical network I hope, it's still at least checking CORS headers, otherwise it mi
by xg15 4y ago
> it didn't take incoming requests from anything except the bank's internal physical network
I hope, it's still at least checking CORS headers, otherwise it might be vulnerable to a drive-by attack [1].
(At least if some device on the local network runs an older browser which does not implement CORS Private Network Access headers yet [2])
[1] https://wicg.github.io/private-network-access/#biblio-drive-by-pharming https://wicg.github.io/private-network-access/#biblio-drive-...
[2] https://wicg.github.io/private-network-access/ https://wicg.github.io/private-network-access/
- watwut 4y agoThat sort of stuff is usually dealt with at application server or somewhere around that level. The developer working on rules themselves is never encountering http requests themselves. Or very rarely. That is how actual secure coding is achieved - by dealing with headers and requests in one standard well tested place. Actual new development is separated, so there is no need for someone working on trading engine to deal also with cors
- zabzonk 4y agodidn't use http