3 ms·
I also don't get it. The whole reason for CORS is "Resource Sharing" (e.g. indirectly using resources like cookies belonging to another domain). With direct soc
by olalonde 4y ago
I also don't get it. The whole reason for CORS is "Resource Sharing" (e.g. indirectly using resources like cookies belonging to another domain). With direct sockets, no shared resource is being accessed, all the browser does is open a TCP connection (e.g. no cookie accessed or sent anywhere).
I can understand that TCP connections could be abused by some websites (e.g. using your browser for spamming, accessing unsecured local services, etc.) but this can be solved with a permission style popup just like with the geolocation or webcam APIs.
- Timon3 4y agoI'm pretty sure "Resource Sharing" is about resources on a server being loaded from other origins, not about sharing client-side information. This is a client-side restriction. By offering an alternative you ship a workaround for CORS, effectively disabling it.
- olalonde 4y agoIf that's the case, what does it protect against? Reducing server load? This has always been trivial to bypass by proxying requests through a server. With a direct socket it would be the same except you wouldn't require a proxy server.
- Timon3 4y agoYes, the way you're stating it is fully correct. It is trivial to circumvent, but it would be so in your scenario too - sharing cookies is easy to implement in a proxy server. Still, for a simple website it's a big hurdle, since it forces you to build a proxy server.