4 ms·
I think cors can prevent that. You can't make a cross origin request from an origin that isn't allowlisted
by bastawhiz 7mo ago
I think cors can prevent that. You can't make a cross origin request from an origin that isn't allowlisted
- inetknght 7mo agoYou really think a server-controlled CORS list will protect you from a client-side configuration issue?
- bastawhiz 7mo agoIt's not a client side configuration issue. You're not protecting against software the user has installed, you're protecting from arbitrary origins hitting the hostname. That's literally the exact reason cors exists.
- 15155 7mo agoTiming attack on the preflight.
- bastawhiz 7mo agoThe DNS lookup will take an indeterminate amount of time and the cors failure is cached. You can't really effectively do a timing attack, especially if the client and the real server take a random time to respond. You get exactly one sample.
- 15155 7mo agodetect-ccd.creativecloud.adobe.com returns NXDOMAIN. Why can't you request a different resource to get more than one attempt?