5 ms·

All I want to do with a browser that I can't do normally is disable CORS. Which genius decided that a webserver on localhost was infinitely more trustworthy th

by Dwedit 4y ago

All I want to do with a browser that I can't do normally is disable CORS. Which genius decided that a webserver on localhost was infinitely more trustworthy than a file:// url?

supriyo-biswas 4y ago
`chromium-browser --disable-web-security --user-data-dir ~/chromium-cors-disabled-profile`
- egeozcan 4y ago
  This is perfectly fine for trusted sites, and I've used it a lot in the past for a few, but it disables cors for everything, and that's a bit too much. What I want is unrestricted access for my code, and that the sites keep the sandbox. What I do nowadays is start a server that has basic auth and zero cors, that I can send commands to from my scripts, like, fetch me this resource without cors, or download this to this folder, etc.
  - purplecats 4y ago
    what about `connect-src`
  - jjeaff 4y ago
    I use the force-cors chrome extension. But I may be misunderstanding your use case.
- jefftk 4y ago
  This goes a lot farther than disabling CORS checking: it turns off all same origin policy enforcement. So, ex, if site A opens a tab on site B (and so gets a reference to it), site A can read and modify anything on that page. Or, ads loaded in cross-origin items could read and modify anything on the containing page. It's fine for testing, but don't log into any real accounts in this profile!
- seanp2k2 4y ago
  Even more ridiculous is the HSTS requirement for localhost, which inspired me to share the techniques in https://github.com/ip2k/I-Dont-Care-About-HSTS-For-Localhost https://github.com/ip2k/I-Dont-Care-About-HSTS-For-Localhost for automating a bit of the frankly ridiculous and idiotic process required to work around this. Who the heck needs a REAL SSL cert for local web dev, and why is it so hard to permanently override that?!
HeavyFeather 4y ago
file:// can access any file on your computer, out of the box. Localhost cannot (unless you set it up that way, which requires user action) That’s why.
andrewstuart 4y ago
If you have a Mac, in Safari "develop/disable cross origin restrictions".
jjeaff 4y ago
I use the chrome extension force-cors.
lannisterstark 4y ago
I hate cors with all my being. It kills so many of my webdev shit when I just want to test something simple but now I have to set a backend up.
- thih9 4y ago
  Are you still referring to accessing a file:// resource? Wouldn’t it be enough to run “python -m http.server 8000” in the desired directory? This sounds simple and quick to me. Or am I missing something?
  - Lalabadie 4y ago
    I ran into some of these concerns when working on a sandbox feature where users select their own files to use in an iframe. Once in production, sometimes you want the user's browser to serve these local files to itself, from blobs and/or the local file system, meaning a server or CLI isn't feasible. This should be better from a privacy standpoint since files stay completely client-side, but CORS difficulties end up encouraging developers to push files to the server at least temporarily instead.
    - haswell 4y ago
      > This should be better from a privacy standpoint since files stay completely client-side, but CORS difficulties… Isn’t this privacy tradeoff directly at odds with security? i.e. local access would also open the door to malicious sites accessing the local file system? I can understand the dev-time frustration with CORS, but removing it just reintroduces a whole category of security issues. Maybe there is something better, but whatever replaces it would need to include similar restrictions.
      - alwaysthevictor 4y ago
        >Isn’t this privacy tradeoff directly at odds with security? i.e. local access would also open the door to malicious sites accessing the local file system? Look at docker for analogy. Sometimes you just need a volume to use locally, but you don't necessarily need to access files that already exist. Consider the use cases of /tmp/ as well, for instance.
FpUser 4y ago
Yeah, this drives me nuts and currently prevents me to add some features to product.
tgv 4y ago
A local webserver doesn't allow you to open every file on your file system, and there's no guarantee that a particular ip address is a local web server. If you really need it, run python -m http.server in /. That starts a local file server at port 8000.
seanp2k2 4y ago
Even more ridiculous IMO is the requirement for a REAL AND VALID SSL CERT for localhost. I made https://github.com/ip2k/I-Dont-Care-About-HSTS-For-Localhost https://github.com/ip2k/I-Dont-Care-About-HSTS-For-Localhost to share some of the frankly ridiculous techniques required to work around this in temporary and more permanent ways.
- franga2000 4y ago
  Forced HSTS, Certificate Transparency checking and limiting key features to "secure contexts" (including the way those are defined) were truly the worst decisions in recent web history...
MF-DOOM 4y ago
You can disable this by running Chrome with —-disable-web-security. If you only need this to access local files, you can do —-allow-file-access-from-files

by Dwedit 4y ago

All I want to do with a browser that I can't do normally is disable CORS. Which genius decided that a webserver on localhost was infinitely more trustworthy than a file:// url?

supriyo-biswas 4y ago

`chromium-browser --disable-web-security --user-data-dir ~/chromium-cors-disabled-profile`

egeozcan 4y ago
This is perfectly fine for trusted sites, and I've used it a lot in the past for a few, but it disables cors for everything, and that's a bit too much. What I want is unrestricted access for my code, and that the sites keep the sandbox. What I do nowadays is start a server that has basic auth and zero cors, that I can send commands to from my scripts, like, fetch me this resource without cors, or download this to this folder, etc.
- purplecats 4y ago
  what about `connect-src`
- jjeaff 4y ago
  I use the force-cors chrome extension. But I may be misunderstanding your use case.
jefftk 4y ago
This goes a lot farther than disabling CORS checking: it turns off all same origin policy enforcement. So, ex, if site A opens a tab on site B (and so gets a reference to it), site A can read and modify anything on that page. Or, ads loaded in cross-origin items could read and modify anything on the containing page. It's fine for testing, but don't log into any real accounts in this profile!
seanp2k2 4y ago
Even more ridiculous is the HSTS requirement for localhost, which inspired me to share the techniques in https://github.com/ip2k/I-Dont-Care-About-HSTS-For-Localhost https://github.com/ip2k/I-Dont-Care-About-HSTS-For-Localhost for automating a bit of the frankly ridiculous and idiotic process required to work around this. Who the heck needs a REAL SSL cert for local web dev, and why is it so hard to permanently override that?!

HeavyFeather 4y ago

file:// can access any file on your computer, out of the box. Localhost cannot (unless you set it up that way, which requires user action) That’s why.

andrewstuart 4y ago

If you have a Mac, in Safari "develop/disable cross origin restrictions".

jjeaff 4y ago

I use the chrome extension force-cors.

lannisterstark 4y ago

I hate cors with all my being. It kills so many of my webdev shit when I just want to test something simple but now I have to set a backend up.

thih9 4y ago
Are you still referring to accessing a file:// resource? Wouldn’t it be enough to run “python -m http.server 8000” in the desired directory? This sounds simple and quick to me. Or am I missing something?
- Lalabadie 4y ago
  I ran into some of these concerns when working on a sandbox feature where users select their own files to use in an iframe. Once in production, sometimes you want the user's browser to serve these local files to itself, from blobs and/or the local file system, meaning a server or CLI isn't feasible. This should be better from a privacy standpoint since files stay completely client-side, but CORS difficulties end up encouraging developers to push files to the server at least temporarily instead.
  - haswell 4y ago
    > This should be better from a privacy standpoint since files stay completely client-side, but CORS difficulties… Isn’t this privacy tradeoff directly at odds with security? i.e. local access would also open the door to malicious sites accessing the local file system? I can understand the dev-time frustration with CORS, but removing it just reintroduces a whole category of security issues. Maybe there is something better, but whatever replaces it would need to include similar restrictions.
    - alwaysthevictor 4y ago
      >Isn’t this privacy tradeoff directly at odds with security? i.e. local access would also open the door to malicious sites accessing the local file system? Look at docker for analogy. Sometimes you just need a volume to use locally, but you don't necessarily need to access files that already exist. Consider the use cases of /tmp/ as well, for instance.

FpUser 4y ago

Yeah, this drives me nuts and currently prevents me to add some features to product.

tgv 4y ago

A local webserver doesn't allow you to open every file on your file system, and there's no guarantee that a particular ip address is a local web server. If you really need it, run python -m http.server in /. That starts a local file server at port 8000.

seanp2k2 4y ago

Even more ridiculous IMO is the requirement for a REAL AND VALID SSL CERT for localhost. I made https://github.com/ip2k/I-Dont-Care-About-HSTS-For-Localhost https://github.com/ip2k/I-Dont-Care-About-HSTS-For-Localhost to share some of the frankly ridiculous techniques required to work around this in temporary and more permanent ways.

franga2000 4y ago
Forced HSTS, Certificate Transparency checking and limiting key features to "secure contexts" (including the way those are defined) were truly the worst decisions in recent web history...

MF-DOOM 4y ago

You can disable this by running Chrome with —-disable-web-security. If you only need this to access local files, you can do —-allow-file-access-from-files