3 ms·

There was a brief window when people knew that if they used non-HTTP protocols, then malicious webpages couldn't talk to it. But now even "native" apps are web

There was a brief window when people knew that if they used non-HTTP protocols, then malicious webpages couldn't talk to it. But now even "native" apps are web apps, and IoT devices all use web APIs too. They can be locked down through CORS etc., but it's easier for devs to set `Access-Control-Allow-Origin: *` and worry about it "later".

kevincox 3y ago
In most cases `Access-Control-Allow-Origin: ` is actually a decent policy. It importantly blocks cross-site credentials. So as long as your API has any* authentication it should prevent it. The real mistake is mirroring the Origin header from the request in the `Access-Control-Allow-Origin` response header which allows credentials (unless you add other headers) Of course this all relies on you not accepting form posts without auth.