7 ms·

Developers don't understand CORS (2019)

• piyh 4mo ago
  The only thing I remember about CORS is that it takes way longer than expected to debug, by design the error messages sent to the browser are intentionally gutted, and CORS error scenarios are hard to tell from other failure modes atfirst glance.
  • deathanatos 4mo ago
    > by design the error messages sent to the browser are intentionally gutted A CORS error is not "an error message sent to the browser", it is an error generated by the browser, because the browser has decided it cannot permit the request. (Though certainly a server can not understand a CORS request as such, and returned a weird response, which would then end up getting translated to a CORS failure.)
    • ameliaquining 4mo ago
      I think what the person you're replying to is trying to say is that the web-accessible error message (i.e., the one that JavaScript running in the sending page can read) is intentionally opaque and somewhat misleading, because a more helpful error message would leak information about the response that the sending origin isn't supposed to have. There's typically a more helpful error message in the dev tools (which JavaScript running in a page can't access), but you have to know where to find it.
      • moring 4mo ago
        The message in the dev tools is, at least for Chrome, extremely developer unfriendly: The blocked request is displayed in a very strange way, without any information that it was blocked, nor that CORS was the reason for it, nor how that decision was made based on the preflight request. You have to already know from experience that these strange devoid-of-information requests have been blocked by CORS, then find the preflight request, and there you will find a bit more information, but still much less than would be possible to show. Showing more information would, AFAIK, not circumvent the layer of security that CORS (or actually origin isolation, which CORS makes an exemption from) adds. My best guess is that this just had very low priority when building the dev tools.
• deathanatos 4mo ago
  Generally when I'm debugging these, I need/want to know what was the preflight (if applicable), and was the preflight what was expected? When I help others debug these, generally I find there is little expectation of what the preflight "should" be, and instead just a bunch of stochastic attempts to adjust the server's response headers to get the browser to capitulate — regardless of whether that makes any sense at all. I would also say I think Firefox's network inspector is better in this area. (But I'm often having to ask others to "no, don't send the failing request, send the CORS preflight", we need to understand what happened with it.) > Anecdotally, lots of developers I’ve talked with don’t understand well how CORS works. Yeah, most FE devs I've worked with seem to not understand CORS. > Is the CORS API too complex and confusing I think it can be hard if you don't understand why the exceptions to preflights are what they are, but the moment you internalize "because the browser can already emit that request in other cases" then it becomes obvious what categories are what & why.
• jdw64 4mo ago
  Sometimes I'm not even sure what I truly 'understand.' When even senior engineers working on products used by hundreds of millions of people, like Zoom, have had these kinds of issues, it makes me wonder. So I usually just write code the way it was left by my seniors, out of inertia. But I realize that the area I work in is actually incredibly abstracted.
• mock-possum 4mo ago
  I honestly just can’t be arsed. I write the code to do the thing I want, and if CORS throws a wrench into things, I make Claude fix it for me. I’m tired boss.
  • postsantum 4mo ago
    Good for you. It's the responsibility of the boss to hire someone to type "claude pls check if prorgam not safe"
  • trick-or-treat 4mo ago
    , claude fixes it by doing insecure shit, your secrets end up exposed, you end up running a $10,000 api bill, you wonder how you got there.
  • throwaway7356 4mo ago
    Yes, many developers give nothing about even basic security. That's why we still have every basic security issue like hardcoded passwords, SQL or other injections, XSRF and so on repeated on an endless loop. Even if they are trivial to avoid.
• encomiast 4mo ago
  It's not just CORS that's hard to understand. Many (most?) developers don't really understand the threat model. And even when it's explained it hard to see why it's a big deal. Part of this is that backend developers usually have to configure CORS and it's not an access privilege protection. From the point of view of the backend it doesn't seem to matter. Bad guys can't get it. From the point of view of the front-end it's often seen as a nuisance. The article does a nice job giving a concrete example.
  • cookiengineer 4mo ago
    On top of that, it's a threat model that doesn't make really sense from an attacker vs defender perspective. Because it's optional, and all kinds of other libraries and tools can just blatantly ignore it anyways. CORS literally exists only against XSS and CSRF for actively logged in human users. Anything else in CORS is absolutely pointless because every other attack scenario uses scripts or programs that fake HTTP headers anyways. It's just as useless as the Sec-CH (client hint) headers because some Browser made by a company that starts with Micro and ends with Slop decided that the User Agent always needs to be Windows 10 for compatibility reasons. That is why you see everyone just enabling every CORS option anyways, even though that is literally the worst case that allows XSS and CSRF. And a lot of websites have user edited content at some place, at the very least in images that aren't filtered for embedded scripts (PNGs, anyone?).
    • wonnage 4mo ago
      What else is there in CORS? It’s all basically a way for an origin to communicate to the browser which other origins it can share data with. Of course if there’s no browser involved then there’s no need for it. Client hints are useful for all the shitty “responsive” websites that don’t know how to use media queries. And for ad tracking. Mostly the latter
  • yaur 4mo ago
    It’s not that hard to understand… in the cors threat model an attacker gets one your users to take an action on your site by visiting their site.
• frogulis 4mo ago
  From my experience, the reason CORS is hard to understand is that it's somehow inverted from the default "shape" of security in web dev. We easily form the intuition of the client being a by-default untrusted entity, and checking whether it has the privilege of accessing this data, where the server is the arbiter of that access. CORS is so inherently different to that, and while the information is easily available, it requires a short but careful read to grok the idea -- which a dev tunnel-visioning towards getting their application code written may not wish to slow down for.
  • trick-or-treat 4mo ago
    I think that once you understand that CORS is about protecting the visitor not the server you're halfway there. Also, if you have everything set up properly, the fact that you're haveing any CORS issues at all means you're probably trying to do something stupid and you need to ask someone smarter how to solve your problem.
• dboreham 4mo ago
  The only thing to understand is that it does nothing useful today.
  • paulryanrogers 4mo ago
    Doesn't it help protect clients from malicious 3P JS? At least so long as they don't have malicious extensions or a non-CORS browser?
  • kristiandupont 4mo ago
    What do you mean? It's a way to mitigate a certain attack vector and as far as I can tell, it works as intended given the circumstances it was designed under.
• robertclaus 4mo ago
  I bet there's an awful lot of servers out there that will happily take CORS requests from any host because someone didn't understand why their second domain couldn't talk to the same API.
  • ChadNauseam 4mo ago
    That describes pretty much every server I've ever written lol.
  • ivanjermakov 4mo ago
    Sometimes it's a good thing when I try to use someone else's backend in my web app. For example map tile server or route builder, which are session-less and have no authentication. The idea that HTTP servers are restricted to requests from a single domain by default is strange, wonder if CORS world be better off opt-in rather than opt-out.
    • kaoD 4mo ago
      > wonder if CORS world be better off opt-in rather than opt-out. It's necessary that the defaults are secure. More so, not less, if the problem is hard.
• iririririr 4mo ago
  everything browser is about still allowing The Bad Thing Ad Companies need. cors et al is a freaking mess because those things are designed by a comitee choke full of people who last promotion was their cool idea about how to monetize referrer, or how do cookie match across domains, or profile you with millisecond it takes to list your usb audio devices, or etc etc etc
• preommr 4mo ago
  Because, like many things in web, it's a patchwork of compromises due to legacy issues, rampant inconcistencies and trying to be too clever. You get results where it's really difficult intuitively understand it because at that point you're not really meant to. Realistically, people just follow a guide, or some lib, and move on.
• koolala 4mo ago
  CORS sucks since Cross-Origin-Embedder-Policy: credentialless was never made standard across all browsers. It's a browser client restriction you can't turn off. If you want to do anything interesting with WWW content you have to run your own browser or run an out-of-box one off a proxy server that breaks everything.
  • 9dev 4mo ago
    > If you want to do anything interesting […] you have to run your own browser This is usually a sign you don't really understand what you're doing.
    • koolala 4mo ago
      Its not? Remember the 90s? There was a beautiful time before CORS and DRM in the browser. Browsers used to be something that actually cared about allowing full client control.
      • 9dev 4mo ago
        But it isn't the 90s anymore. Billions of people are using the internet, doing everything from voting to shopping to managing their stock portfolio. There are valid reasons why we have security protocols. And aside from that - it's not like CORS is preventing you from anything. The only requirement is to read up on it, understand it, and configure your web server accordingly. If you're unable to do that, or you'd rather create your own browser, then the only conclusion I can draw is that you're either unwilling or unable to take proper care of the security of your users.
        • koolala 4mo ago
          I don't care about my server. It has everything to do with what it is preventing my browser client from doing. The whole point is using content from the whole web not my server.
          • 4mo ago
• stephbook 4mo ago
  I still don't understand the threat model and, obviously, it's not explained here either. I log in to social.net. I click on scam.org and change sites. I'm on scam.org and it triggers a request to social.net/friends. No cookies are sent, no JWT. I'm not logged in and get a "Needs login" HTTP error. Nothing bad happens. I thought that's how it works without CORS already.
  • teaearlgraycold 4mo ago
    Cookies will be sent if SameSite=None. Because a lot of the web's security features were implemented well after the tech was popular it's a patch-work with lots of overlap.
  • abraham 4mo ago
    By default cookies are sent for cross-origin requests. The SameSite cookie flag that lets sites control this was only shipped in Safari the year before this blog post was written so it would have been hard to depend on it yet. https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Cookies#controlling_third-party_cookies_with_samesite https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Coo...
  • inigyou 4mo ago
    Your cookies are sent.
    • koolala 4mo ago
      Then why wasn't credentialless a simple fix to solve that. Not sending cookies isn't hard.
      • inigyou 4mo ago
        Because that would break things. You couldn't stay logged into HN without cookies. Cookies aren't just for credentials, imagine hotlinking to an image and getting a different language version because your language cookie wasn't sent.
• OffBeatDev 4mo ago
  [flagged]
• physix 4mo ago
  > Developer's don't understand CORS Count me in!
  • zdc1 4mo ago
    Even the HN comments here are a sea of confusion and contradiction. It's stunning and makes me wonder whether CORS is a bad solution, or if it's solving a hard problem.
    • bazoom42 4mo ago
      CORS is counter intuitive. I don’t think there is a better way to solve the problem, it is just a difficult to understand problem. CORS errors occur when JavaScript in the browser attempts to call a server which is not configured to allow it. But the check is purely client-side. You can circumvent it entirely by using curl or whatever outside the browser. For example the server sends a header indicating which domains it allows requests from, but it does not actually check if requests are from those domains. It is the responsibility of the client to check its domain is allowed. All this make it seem like a pretty useless security feature, unless you understand the very specific kind of attack this protects aginst.
      • sureglymop 4mo ago
        Could you go the full mile and explain that very specific kind of attack?
        • bazoom42 4mo ago
          Example: I post “fungame.com” on Show HN, you visit it, and in the background the JavaScript calls Facebook on your behalf (using your Facebook authentication cookie) and adds me as friend. By default such cross-domain requests from JavaScript are disallowed, but CORS allows it if the server specifically opt-in. But the check happen in the browser, since the purpose is to protect the user of the browser. There are some weird exceptions to this, for example a client can always GET and POST data to another domain under certain constraints, since this have always been possible using HTML forms. So it is not obvious what is possible and what isnt.
• piterrro 4mo ago
  Wait, isnt it implemented because of the sheer number of broswers that could be used at the Zoom’s scale? They could’ve used jsonp too it they wanted to bypass CORS. Using image with different dimensions sounds like the most bulletproof way across multiple devices/OSes/browsers
• ottoflux 4mo ago
  the amount of code i've seen either allowing * when it shouldn't because someone was desperately trying to make their code work is astounding. contractors, "specialists", etc. who never took the time to read how CORS works and how simply you can handle a list of allowable sites, etc. it's only complicated until you take the 5-10 minutes to properly understand what happens where. if you don't know, go do it now.
  • oofbey 4mo ago
    As somebody who has spent a lot more than 10 minutes trying to figure out why CORS was blocking what seemed legitimate, I sympathize with people doing the wrong thing, and disagree with your assertion that it’s not that complicated. Maybe I’m just slow. But objectively I know I’m not.
    • N_Lens 4mo ago
      “Objectively”
  • bornfreddy 4mo ago
    5-10 minutes? I'm sold. Any link you can share? I'm saying this as someone who has learned about CORS protections many times, implemented the solutions with care they deserved, but forgot most of it soon after - each time. So I'd be very happy to invest even 15 minutes to break this cycle.
• foundart 4mo ago
  Correct. Where are some good explanations?
• rfmoz 4mo ago
  [dead]
• kartoshechka 4mo ago
  - cors docs are written either from solution or implementation point of view, not the "why this exists, and how we successively deal with bad actors trying to game cors", cors RFC is terse - protocol itself is quite nuanced, like iirc requests with Authorization (or some other) headers don't obide by usual rules, and again for developer it's just an arbitrary convoluted set of rules, if they don't grasp the problematics - backend and frontend should work in unison to have correctly configured cors, but as we know, devs hate communicating with each other
• supriyo-biswas 4mo ago
  I wish more people read the CORS article on MDN[1] which helped me a lot at the time when I was trying to understand it. I knew some people had trouble with CORS but had no idea it was this bad, going by the comments here. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/COR...
  • nedt 4mo ago
    Exactly this. I can only upvote you once, but this is one article that should answer all the questions. Not just the simple origin case, but also how a preflight works.
• ozim 4mo ago
  Issue is that for most projects CORS is set and forget. You don’t run into it once a month or even once a year - you run into it when setting up new project from scratch. Many or most developers work on existing projects that have all kinds of security defaults set somewhere in the past and no one bothers reviewing those.
  • PunchyHamster 4mo ago
    Nah the clowns at standard board just decide to fuck shit up every few years and add some new mess to CORS that breaks in some subtle edge case on existing setup
• muvlon 4mo ago
  Even TFA seemingly doesn't understand CORS. Or at least misreprents it grossly: > The webserver listening in on localhost:19421 should implement a REST API and set a Access-Control-Allow-Origin header with the value https://zoom.us https://zoom.us. This will ensure that only Javascript running on the zoom.us domain can talk to the localhost webserver. No, that does not do that. JavaScript from any other website can still talk to localhost:19421 just the same. CORS doesn't restrict anything, it loosens the default set of restrictions (ignoring preflight requests for now and assuming we're talking just about "safe" Methods). That Access-Control-Allow-Origin header just allows JavaScript running on zoom.us to read the responses when it queries localhost:19421. The requests happen in any case, and you must ensure in your backend that they don't cause any adverse effects.
  • Lerc 4mo ago
    I don't think you can even say CORS does that. The degree to which CORS is poorly understood (I have read numerous (often contradictory) documentation and I don't really understand it.) means that you can't rely on it being implemented properly by an unknown party, If a protocol reaches this level of widespread confusion, I think all bets are off. Even if one end of a system performs correctly, who's to say that the other will. If people adapt their code until it works with another implementation, were they mistaken, or the other end?
    • RobotToaster 4mo ago
      It seems like nobody understands CORS. Including me TBH.
      • Beltiras 4mo ago
        I don't understand it. And I'm a web developer. I don't understand the documentation, I don't understand the problem it's trying to solve and I don't understand how it's going about a solution of any problem. The closest I've come to an understanding is that it's meaningless make-work for a ledger of http calls that are not giving any security.
• mparnisari 4mo ago
  I'm one of them. CORS is THE topic that I have to get a refresher for periodically. It's like I forget about it, it never sticks. I'm a backend developer so I never encounter any cors issues. Maybe that's why? I seem to forget things that I don't use on a day to day basis, so.
  • yen223 4mo ago
    The biggest problem with CORS is precisely that most CORS errors show up as a frontend problem - specifically, a browser problem - but it needs to be fixed on the backend
  • cyberrock 4mo ago
    The DX for CORS and CSP is horrible because none of the browsers point out where the problem is coming from. In a sane world they would all write "response header" or "meta tag" somewhere in the message but the Riddler, Jigsaw, the Cheshire Cat were each hired by the major browser vendors to write the error messages. Chrome is the closest with "requested resource" but that's still downright cryptic. But on the other hand I'm glad all three of them still agree on something. Edit: I realize that this is a fairly non-constructive comment, so to fix that, my suggested replacements are: Resource https://bank.com doesn't allow cross-origin requests due to lack of CORS headers. (Link to preflight request in Network tab) CORS protects against unaffiliated sites requesting data from your server. (Link to MDN) Resource https://bank.com doesn't allow cross-origin requests because this origin isn't in its CORS allowlist. (Link to preflight request in Network tab) ... Resource https://... can't be fetched due to CSP headers in this page. (Link to page request headers or meta tags in inspector) CSP prevents unauthorized scripts from executing on your page. (Link to MDN)
  • 1dom 4mo ago
    I feel the same. Unfortunately, I've had to deal with CORS in a few situations where the request is "we need to get this thing from this server, but we can't change the servers CORS or CSP", which, in technical security speak is "we have this security system in place, we need to circumvent it". Ultimately, it almost always depends on the server only being accessed via an untampered browser request. The Zoom exploit was able to happen because CORS and CSP are so easy to get around on the client side, so Zoom did it. Sure, Zoom were bad/lazy/silly for doing it, but I feel we're bad as a community for still having this model.
• rishabhpoddar 4mo ago
  I agree that CORS is hard to understand and fix. I was the CTO at an auth company and SO many of our users used to run into various CORS issues and asked questions on our support. However, I'd now argue that developers don't need to understand CORS anymore.. cause claude / gpt does! Just throw in the error in claude code / codex and it would fix it.
  • gum_wobble 4mo ago
    > developers don’t need to understand X … cause claude does! …………………
  • stephantul 4mo ago
    The second part of this comment is not what I expected. I also don’t think it is true. I got bit by a CORS error at work recently that passed by Claude, copilot, and another senior engineer.
  • sourcecodeplz 4mo ago
    damn where are we heading?
    • 9dev 4mo ago
      It's astounding how willingly people give up their agency. Dystopic sci-fi novels turn out to be bogus, because nobody will rebel against the machines if it prints funny progress indicator words to the terminal
      • Ekaros 4mo ago
        I am actually starting to believe that those stories where everything was offloaded to AI will come true. And not enough people will actually care even when pointed out... They haven't done much wrong this far...
    • Keyframe 4mo ago
      Start learning security, this will be a great career going forward!
• somat 4mo ago
  It's me, CORS was the stupidest thing I encountered in a long line of stupid when trying to put together a simple web app for the first time. "So let me get this straight. We tell the client whether the application we gave them can or cannot make requests to our servers. And none of this actually prevents the client from making the requests if they want to?... Pull the other one it has bells on." It took a good sleep and a long shower to under stand it. "Oh... it is for if I want to do a self injection attack and allow random untrusted malicious code in my application. In other words, ads" Basically the threat model is inverted from any other threat model, that is why it looks so stupid. CORS is threat model used for when you can't trust your self.
  • gf000 4mo ago
    Well, it's easy to "not trust yourself" when you have user-submittable content that you display for other users. Sure, one should absolutely sanitize it, but layered security is important.
  • sciencejerk 4mo ago
    Eh, or maybe you landed on a malicious site or clicked on a malicious phishing link which opened your browser
  • throwaway7356 4mo ago
    > CORS is threat model used for when you can't trust your self. No. But many lack basic understanding of web technologies or facts like that a browser can be used to access more than a single site. This leads to not understanding what problems cross-site requests can cause and thus the impossibility of understanding what CORS is for.
• thomask1995 4mo ago
  I think some sort of gui to help write the cors headers would help tbh. it's quite difficult to get your stack to work for local dev, CI, and prod since each most likely needs different cors headers. Especially if you use tunnels and proxies like we do. What made it click for me though was understanding what problem it solved.
• d--b 4mo ago
  A CORS protected endpoint tells YOUR BROWSER not to let YOU access its content if the website you’re browsing from is not whitelisted. It’s confusing because unlike most security features, it’s meant to protect the users from themselves. The risk comes from a combination of users being allowed to visit malevolent sites and browsers letting all websites do a lot of random stuff, including making 3rd party requests with cookies and private stuff
  • user43928 4mo ago
    Isn't it arguably the opposite? A CORS header in the response tells your browser to relax CORS restrictions.
  • IceDane 4mo ago
    Like the sibling said: CORS is the relaxation of default security features. It's even in the name: Cross-Origin Resource Sharing.
    • koolala 4mo ago
      'No Sharing' is a policy on sharing. Being literal about the name misses their point.
  • moring 4mo ago
    > it’s meant to protect the users from themselves This is false. It is meant to protect users from a confused-deputy attack made by malicious websites, where that website makes a request to a "serious" API but the user has never asked for, or approved, that request. Blaming the user for everything that happens serves nobody.
• vladsiu 4mo ago
  [dead]
• Tanxsinxlnx 4mo ago
  [dead]
• kittywantsbacon 4mo ago
  [flagged]
  • ghoshbishakh 4mo ago
    100% - although it is stunning to see since most LLMs get CORS questions right (which is surprising since they trained on all sorts of incorrect data).
    • Finbel 4mo ago
      Maybe it’s like that trick where if a thousand people guess the amount of beans in a jar almost all of them will be wrong but their average will be very close to, if not, correct.
      • TeMPOraL 4mo ago
        Possibly, but at a semantic level.
      • mattkenefick 4mo ago
        they probably weight documentation higher
        • xnx 4mo ago
          They're applying trust factors similar to PageRank.
    • tgv 4mo ago
      I think many (most?) have preferred sources. I would weight Wikipedia and MDN higher than Snurk Grubble's blog in training, no matter what the topic.
      • marcosdumay 4mo ago
        Also, you can count on most developers to reach the documentation only as a last resort, and try every random blog first.
• ralusek 4mo ago
  I understand CORS and I don't. TL;DR: It's a restriction your browser gives itself. If it's on Domain A and it sees a request going out to Domain B, unless Domain B responds saying that it's expecting traffic from Domain A, the browser prevents itself from making the call. I think the part about it that is off/silly to most people is that it's not a normal security threat model, because a malicious client could simply just...not impose that restriction on itself. You're perfectly capable of going and curling that same request to that backend, or calling it from an app, or any number of other things. So it's not really protecting your protected resource, the backend, from malicious clients. All of that is where I feel like I understand clearly. The part I fail to retain is the exact scenarios it does protect against, which IIRC, are basically about attempting to protect your users from being misguided on other clients that are acting as your client, something like that (but again, this literally only applies to browsers). It's just kind of a weird niche problem that I often find myself thinking "I mean why is the user on another client and have allowed themselves to authenticate on that client with my server...this sounds like the user's fault."
  • eurleif 4mo ago
    The part you may be missing is that cookies exist. User visits A.com, types in their username and password, and a cookie is set in their browser. The browser will send that cookie back to A.com with all subsequent requests, and A.com's server will use it to enable access to the user's account. Now the user visits B.com, which makes a request to A.com/private_user_data. The user's cookie is sent with this request, so A.com will respond with (and B.com will receive) the user's private data without the user consenting to this at all (not even in a "misguided" way).
    • xigoi 4mo ago
      Why not just not send cookies instead of blocking the request completely?
  • 9dev 4mo ago
    > […] the browser prevents itself from making the call. That's not strictly correct, by the way. The request is made, but the JavaScript code on Domain A is not allowed to read the response. This matters when a request is destructive on its own, for example.
• rusk 4mo ago
  It’s TOS for using ebdpoint. It says: access is provided under condition you respect these restrictions You are not obliged to honour this. It is not enforceable so it seems strange. Browsers enforce it, but it can be turned off and nobody expects it to be implemented by a simple REST client application. It’s a gentleman’s agreement. It’s a statement of expectation to the browser. On the one hand it may be for the protection of the browser user, from cross site attacks, and from malicious code on the web. But crucially it provides little protection for the endpoints themselves bar accidental misuse. It is very unusual and rare example of “cooperative” security in a web that’s frequently so adversarial. And that’s what makes it hard to grasp.
  • 9dev 4mo ago
    > Browsers enforce it, but it can be turned off and nobody expects it to be implemented by a simple REST client application. No, you're missing the point. Normal people using normal browsers with default settings have CORS enabled. That's the vast majority of your users; everyone who disables it stupidly opts into a risk themselves without any reason to. So the expectation that CORS is enabled on your user's devices holds. This means it's not a gentleman's agreement!
• himata4113 4mo ago
  It was pretty amusing reading the comment section so I'll chime in: SOP protects you (the browser) from leaking information to websites that should not be able to access that information and CORS allows you to weaken it. Example: SOP stops example.com from fetching the list of subscriptions on youtube.com. But CORS allows example.com to access youtube.com/public/*. This is also not the sole use-case, it also stops your backend api being up under a different frontend which would allow data theft since you could log into real services on google.com, but you're actually on g00gle.com enabling data exfiltration because now every request can be MitM'd.
  • crackalamoo 4mo ago
    I love this, easy intuitive explanation
  • StrauXX 4mo ago
    No, it's exactly the other way around. The SOP protects you from these security issues. CORS is a feature that can be used to loosen up the SOP, to allow more complex inter-application behaviour.
    • himata4113 4mo ago
      ah right, my own brain got jumbled from reading all the comments forgetting that cors: '*' is not the default.
    • flux3125 4mo ago
      And now he's part of the confusing comment section lol
      • himata4113 4mo ago
        I fixed it, it stays relatively the same vs original explanation, just had inverted defaults I have no idea why I thought '*' was the default. Definitely impacted by the confusing comment section haha.
  • krackers 4mo ago
• formit34 4mo ago
  [dead]
• drchaim 4mo ago
  I understand CORS each time I need to fix or to avoid them ;)
• StrauXX 4mo ago
  This blog post is very misleading. > So what would a secure implementation of this feature look like? The webserver listening in on localhost:19421 should implement a REST API and set a Access-Control-Allow-Origin header with the value https://zoom.us https://zoom.us. This will ensure that only Javascript running on the zoom.us domain can talk to the localhost webserver. First of all, its not CORS that protects. CORS is an anti-security feature. What does protect is the SOP (same origin policy). The SOP (or SOPs rather, it's not really one feature but more of a paradigm in the standards) blocks documents from one origin, from reading data that belongs to another origin. This is the reason why `let w = window.open("https://example.com https://example.com"); console.dir(w.document.body);` will work when it is ran from example.com, but not wikipedia.org. Only when protocol, host and port match, can documents access each others data (there is an interesting differential with cookies here, their SOP only looks at protocol and host, not port). Importantly, the SOP only blocks reading data from other origins, not writing! So while example.com won't be able to read the response of a post request it sends to wikipedia.org, the request is sent and processed nontheless! CORS now is a feature that allows sites to loosen up the SOP. This allows documents to read cross origin data nontheless. Namely, HTTP responses. (Standards for reading other kinds of data cross origin exist, but are not related to CORS).
• utopiah 4mo ago
  I definitely understand CORS in theory, then when it's time to solve a CORS related error, anything goes. /s
• Izmaki 4mo ago
  I don't fully understand CORS and was hoping he'd explain how it works. :(
• rubendev 4mo ago
  This is really a self inflicted problem. If you host your backend on the same origin as your frontend (using a reverse proxy) you don’t need CORS at all and you can use the vanilla SOP, and strengthen it further with a strict CSP.
  • ricardobeat 4mo ago
    It really is architecture dependent. There are many valid reasons why would not want to route all API requests through your frontend infra, or vice-versa.
• rho138 4mo ago
  People hating on web developers and/or saying application developers are better and then everyone bombs the RFC challenge.
• karol 4mo ago
  CORS, CSRF and CSP get the job done;)
• theginger 4mo ago
  Cors is hard to understand because the browser is protecting you and the server from malicious code that the developers are not expecting to be there. Its a hypothetical threat you cannot see during development unless you really go out of your way. If you can't see the threat it's hard to understand it, it you don't understand the threat it's hard to understand the protection against it. Its one of those situations where you need to think like an attacker to see the whole picture.
• impara 4mo ago
  [flagged]
• threethirtytwo 4mo ago
  AI understands CORs. So that's something AI does better than developers.
• lofaszvanitt 4mo ago
  Because they don't like reading docs. At the same time it is an overcomplicated fucking mess, just like CSP headers just like css syntax/wording. Somehow everything that is security related is overly complex.... it's a miracle!
  • brazukadev 4mo ago
    the browser security model is quite efficient and heavily tested tho.
• xg15 4mo ago
  CORS seems to be the Offside rule of the webdev world. I wonder if much of that misunderstanding comes from the threat model being quite unusual and not always easy to understand. For starters, there are three parties, which all don't trust each other: The server, the browser and the JavaScript running inside the browser. The browser is supposed to protect the server against requests from unauthorized JavaScript applications. CORS is there to mark certain requests as "authorized", while keeping the protection active for the rest. But the entire system only works if those three components exist in the first place, as enforcement is solely relying on the browser.
• dofm 4mo ago
  Part of the issue is developers imagining a theoretical solution to a wider problem than CORS is trying to solve. Once you understand that it's onlying to solve problems that happen in a user's compliant browser, and not some wider issue of resource authorisation, it does get a bit easier to understand. Though in a way CORS seems too simple for what it achieves.
• confidantlake 4mo ago
  I thought I knew CORS before but after reading all the comments I don't think I know anything anymore. Guess I will just make a coffee and move on with my day.
• ktzar 4mo ago
  it's one of my favourite interviews questions and very few people get it right.
• tsouth2 4mo ago
  [dead]
• simonw 4mo ago
  To understand CORS, you have to understand the Same Origin Policy. If you find CORS difficult to understand, particularly the question of "why do we need this?", I suggest starting here: https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Same-origin_policy https://developer.mozilla.org/en-US/docs/Web/Security/Defens... I've tried using the Same Origin Policy as an interview question in the past, but it's not a good question because the majority of candidates aren't familiar with it, so you learn very little by bringing it up.
  • embedding-shape 4mo ago
    > I've tried using the Same Origin Policy as an interview question in the past, but it's not a good question because the majority of candidates aren't familiar with it, so you learn very little by bringing it up. For hiring frontend developers, I've found it to be an excellent question, as surely if you've been developing web apps, you essentially must have come across it at some point. If you haven't, I'd be asking more questions about how typically you'd communicate with a backend and so on. Some people have hit the issues related to CORS, worked around it the quickest possible way then forgot all about it, rather than understanding what's going on, also a useful signal for some roles. Bit less good for backend roles, as not everyone has worked closely with a frontend team which tends to be the people hitting issues around CORS.
    • simonw 4mo ago
      Frontend candidates who have worked with CORS still aren't able to explain SOP and why those policies exist, in my experience. CORS is seen an irritation to be worked around. There are a few examples of that in this HN thread!
      • embedding-shape 4mo ago
        > Frontend candidates who have worked with CORS still aren't able to explain SOP and why those policies exist, in my experience But that's exactly the kind of thing you want to surface in the hiring process with that question :) I guess it depends on if you're hiring juniors to be trained, or seniors to elevate your current team, but personally I'd skip very quickly on people who don't know the basics of their jobs, unless of course the point is to hire them to train them.
• ankitraj1224 4mo ago
  [flagged]
• yearesadpeople 4mo ago
  The comments - helpfully - are great examples of the essence of what the article is attempting to communicate. Bravo!
• sala0986 4mo ago
  [flagged]
• revetkn 4mo ago
  I did not really understand CORS until I sat down and wrote a server implementation of it and had to think hard about "what hooks should be exposed to developers for controlling it?" Most of us I think just "expose a set of whitelisted origins and be done with it". Here is where I landed for how to specify your server's CORS policy: https://soklet.com/docs/cors#custom-workflow https://soklet.com/docs/cors#custom-workflow
• sivalus 4mo ago
  CORS could be handled by your SRE/DevOps/Security equivalents and they will probably do it better because they more often operate while seeing the entire landscape. Feature developers are typically trying to work in a particular area at a time and lose 'peripheral vision'. Or maybe it's something to be learned at the staff/late senior level where you can get more of that perspective because you should have more freedom. The situation in this article also means this was missed by their security folks as well. Who decided this was a developer's responsibility?
• Calgaryp 4mo ago
  I remember as a student that CORS problems drove me crazy. 6 years later, nothing changed
• PunchyHamster 4mo ago
  CORS is just patch over patch over patch on a terrible idea on how to provide theatre of security
• default-kramer 4mo ago
  I understand how the Same Origin Policy protects browsers from executing malicious scripts. I also understand how the Access-Control-Allow-Origin header can be used by servers to declare additional origins as trustworthy, relaxing the SOP. What I still don't understand is what purpose the Access-Control-Allow-Headers header serves. It doesn't seem like it improves security for the browser (and definitely not for the server). Was it included "just for completeness" by the protocol designers? See also https://stackoverflow.com/questions/17992042 https://stackoverflow.com/questions/17992042
• xtracto 4mo ago
  Ha! I kind of understand (apparently not really well from reading comments) CORS and many other web dev related constructs but oftentimes choose to work around them like what the zoom people did on the article exactly for this reason: https://news.ycombinator.com/item?id=48616086 https://news.ycombinator.com/item?id=48616086 The whole thread shows that It seems even highly technical people that supposedly know a lot about this shit get it wrong. Because the mechanics are so complex, nobody really knows how they really work. Or it is a freaking mess or chore to achieve something. Similar to just making a website HTTPS... even with let's encrypt and certbot , why does making a site https have to be so hard? (Try it on a service within a vpn).
• apitman 4mo ago
  > Is the CORS API too complex and confusing Yes
• dang 4mo ago
  Discussed at the time: Developers don't understand CORS - https://news.ycombinator.com/item?id=20404578 https://news.ycombinator.com/item?id=20404578 - July 2019 (355 comments)
• almog 4mo ago
  I think part of what makes CORS hard to remember is the amount of conditional branches it contains, which partially stems from being modeled to have backward compatibility with HTML forms (which defines how CORS behaves for "simple requests). Remove this legacy trap and there are far fewer cases to remember. Of course, that can't be undone now but I think the original-ish sin was when forms suddenly could perform _both_ cross origin requests _and_ get the ambient authority treatment (i.e. send the user cookies with the request though to be fair, basic auth + forms also enabled similar attacks even before cookies were introduced in the mid 90's).
• themanmaran 4mo ago
  The fact that the top comment [1] sparks a thread debating how CORS does / doesn't work is a great argument in favor of the original title. [1] https://news.ycombinator.com/item?id=48616086 https://news.ycombinator.com/item?id=48616086
• temporallobe 4mo ago
  I read through the comments to make sure I wasn’t the only one…Nobody understands CORS because it’s too complicated and too conflicting. The standards and the headers are always changing too, so mostly what happens is that we developers just tinker with it until it works, then ship the product and call it a day. Even when it works, you may still end up with errors and warnings in the dev console, but as long as things appear to be working, we leave it alone.
  • deleted 4mo ago
    [deleted]
• OhNoNotAgain_99 4mo ago
  [dead]
• naishoya 4mo ago
  It's security theatre all the way from top to bottom: extra effort for devs and users alike, no real comprehension of any of the threat models at any level of interaction from the original design - which makes it fit right in with the rest of the entire java and advertising me-cosystem. It's truly confusing to see businesses with real PII, financial, and technical risks choose not to simply disable java for all websites on work systems' browsers; bake settings and other restrictions into immutable VM templates. From these run ephemoral/disposable, per-application suite VM's to enable the office workers to use the tools required for their jobs. If a worker wants user-upload and FB utility they are free to use their own devices (phones) when they are on break. If a role has specific need for a specific site that requires special refinements/relaxation or the security policies then that can have it's own templateVM and this allows granular control of which VM instances have access to which other instances' clipboard and if it is one-way or bi-directional. These techniques aren't novel, aren't actually that difficult, and are actually in-use in many workplaces. Even on legacy systems this has been possible with Windows environments which require full Office utility - since the XP era with 'Embedded' tools like WindowsCE <~ not the best way to do it, but I have seen it done at scale by multinational enterprises. Every reboot spawns a completely clean; custom configured clone of the 'official' image; and if too much changes - that clone evaporates and restarts from read-only image. All the rest of this ''back-end, front-end, let some people in, keep others out, filter by structure but not by content,'' ... it's just such an exhausting topic to even read about, and i wonder what kind of kool-aid everyone drinks to get them to pretend any of that is actually for any purpose than to allow FAANG/MANGOS/SPAM tech-bro cults to suck up all the user activity meta+data from the free garbage they are peddling. I need either more coffee, or less Uisge beatha bhon Hosh.
• dedoussis 4mo ago
  I've always wondered if part of the root issue is that Same-Origin Policy, and CORS by extension, were not very intuitively designed abstractions/APIs to begin with.