3 ms·
I wish the browser would just say "This website is trying to fetch data from example.com, do you agree?" The whole CORS thing is so off and it destroyed to abi
by yoavm 2y ago
I wish the browser would just say "This website is trying to fetch data from example.com, do you agree?"
The whole CORS thing is so off and it destroyed to ability to build so many things on the internet. I often think it protects websites more than it protects users. We could have at least allowed making cookie-less requests.
- bastawhiz 2y ago> This website is trying to fetch data from example.com, do you agree I don't know, do I? How am I supposed to know? How am I supposed to explain to my mom when to click yes and when not to? The average person shouldn't ever have to think about this. Imagine if any website could ask to access any other website, for an innocent reason, and then scrape whatever account information they wanted? "Do you want to let this website access google.com?" Great, now your whole digital life belongs to that page. It's a privacy nightmare. > it destroyed to ability to build so many things on the internet It only destroyed the ability for any website to access another website as the current user. What it destroyed is the ability for a web page to impersonate users.
- yoavm 2y agoReading cookie-less responses is also forbidden. I couldn't read your Google account information, just make an anonymous Google search through your browser. I fail to see what's the big deal.
- Avamander 2y agoFamous last words
- yoavm 2y agoDo elaborate please?
- smagin 2y agoWhy would you need that? Also, one thing I can speculate that phishing would become even easier if such things were allowed
- yoavm 2y agoBecause defaulting to NOT allowing cross-origin requests made it so that being lazy creates a more closed web. And people are lazy.
- bastawhiz 2y agoOr make 10,000,000 Google searches through my browser and get my IP and account banned. Or process a request containing CSAM that has me reported to the government. Or using my residential internet connection to operate a proxy service, causing my IP's reputation to drop and now I'm stuck solving CAPTCHAs all day. Or, you make requests to lots of sites and see which ones have no responses: surprise! Now you know which websites I have cookies on. Why in the world would I want to let someone else use my device to make requests like that? Use your own device, not mine. Fundamentally this all boils down to you, the person building the site, being cheap. You don't want to pay the handful of dollars to make your own HTTP requests.
- yoavm 2y agoMaking 10m requests to Google, asking for a CSAM image etc are all currently possible with an <img> tag. This does not prevent it in any way. Allowing GET requests would be a very lame proxy service, especially considering that the proxy falls when you close the tab, and that I mentioned the requests should only be allowed cookie-less (credentials: omit). I think it's much more about open web and letting the user decide than about being cheap.
- blincoln 2y agoModern web apps make a mind-boggling number of cross-origin requests, and many of them are to multi-tenant SaaS providers. You'd be constantly flooded with permission popups, and attackers would just host part of their code on one ot more of the popular domains that everyone had gotten used to clicking "allow" for.