2 ms·
`chromium-browser --disable-web-security --user-data-dir ~/chromium-cors-disabled-profile`
by supriyo-biswas 4y ago
`chromium-browser --disable-web-security --user-data-dir ~/chromium-cors-disabled-profile`
- egeozcan 4y agoThis is perfectly fine for trusted sites, and I've used it a lot in the past for a few, but it disables cors for everything, and that's a bit too much. What I want is unrestricted access for my code, and that the sites keep the sandbox. What I do nowadays is start a server that has basic auth and zero cors, that I can send commands to from my scripts, like, fetch me this resource without cors, or download this to this folder, etc.
- purplecats 4y agowhat about `connect-src`
- jjeaff 4y agoI use the force-cors chrome extension. But I may be misunderstanding your use case.
- jefftk 4y agoThis goes a lot farther than disabling CORS checking: it turns off all same origin policy enforcement. So, ex, if site A opens a tab on site B (and so gets a reference to it), site A can read and modify anything on that page. Or, ads loaded in cross-origin items could read and modify anything on the containing page. It's fine for testing, but don't log into any real accounts in this profile!
- seanp2k2 4y agoEven more ridiculous is the HSTS requirement for localhost, which inspired me to share the techniques in https://github.com/ip2k/I-Dont-Care-About-HSTS-For-Localhost https://github.com/ip2k/I-Dont-Care-About-HSTS-For-Localhost for automating a bit of the frankly ridiculous and idiotic process required to work around this. Who the heck needs a REAL SSL cert for local web dev, and why is it so hard to permanently override that?!