3 ms·
Ah ok, so we are talking about dumb old methods. I thought it was something like the fancy APIs that are all the rage these days.
by gtirloni 3y ago
Ah ok, so we are talking about dumb old methods. I thought it was something like the fancy APIs that are all the rage these days.
- Retr0id 3y agoThere was a brief window when people knew that if they used non-HTTP protocols, then malicious webpages couldn't talk to it. But now even "native" apps are web apps, and IoT devices all use web APIs too. They can be locked down through CORS etc., but it's easier for devs to set `Access-Control-Allow-Origin: *` and worry about it "later".
- kevincox 3y agoIn most cases `Access-Control-Allow-Origin: ` is actually a decent policy. It importantly blocks cross-site credentials. So as long as your API has any* authentication it should prevent it. The real mistake is mirroring the Origin header from the request in the `Access-Control-Allow-Origin` response header which allows credentials (unless you add other headers) Of course this all relies on you not accepting form posts without auth.