4 ms·
And why do browsers not let users go "I don't care about what this server's headers say, you will do as I say because I clicked the little checkbox that says I
by TheRealPomax 2y ago
And why do browsers not let users go "I don't care about what this server's headers say, you will do as I say because I clicked the little checkbox that says I know better than you".
(On which note, no CSRF/CORS post is complete without talking about CSP, too)
- syntheticcdo 2y agoYou can! Go ahead and launch chrome with the --disable-web-security argument.
- TheRealPomax 2y agoThat's confusing the statement "I want the option to overrule it" with "I want it disabled". I don't, there's very good reason for them to always be on, but there has to be a way to tell it what I want my browser to do, rather than what a server owner, who spent all of zero minutes accepting the default helmet options, says what my browser should do. In the same way that a browser should let me say which off-site domains, specific scripts, and on-page elements should be blocked.
- siva7 2y agoAlmost as pointless as "Yes, accept all cookies" for our european friends.
- LegionMammal978 2y agoI'd think SameSite/Secure directives on cookies are genuinely important to avoid any malicious website from stealing all your credentials. Otherwise, I'd imagine it's the usual "Because those dastardly corporations will tell people to disable it, just because they can't get it to work!!!"
- tedunangst 2y agoBecause then you will get users whining I didn't know what the checkbox did and you shouldn't have let me check it.
- yoavm 2y agoI wish the browser would just say "This website is trying to fetch data from example.com, do you agree?" The whole CORS thing is so off and it destroyed to ability to build so many things on the internet. I often think it protects websites more than it protects users. We could have at least allowed making cookie-less requests.
- bastawhiz 2y ago> This website is trying to fetch data from example.com, do you agree I don't know, do I? How am I supposed to know? How am I supposed to explain to my mom when to click yes and when not to? The average person shouldn't ever have to think about this. Imagine if any website could ask to access any other website, for an innocent reason, and then scrape whatever account information they wanted? "Do you want to let this website access google.com?" Great, now your whole digital life belongs to that page. It's a privacy nightmare. > it destroyed to ability to build so many things on the internet It only destroyed the ability for any website to access another website as the current user. What it destroyed is the ability for a web page to impersonate users.
- yoavm 2y agoReading cookie-less responses is also forbidden. I couldn't read your Google account information, just make an anonymous Google search through your browser. I fail to see what's the big deal.