3 ms·
CORS isn’t designed to increase security, since the same-origin policy is a secure default. It’s a mechanism to allow pages to access servers that they can’t b
by mr_toad 4mo ago
CORS isn’t designed to increase security, since the same-origin policy is a secure default.
It’s a mechanism to allow pages to access servers that they can’t by default - with the permission of the server operator.
- embedding-shape 4mo agoYeah, basically Same-Origin Policy (https://en.wikipedia.org/wiki/Same-origin_policy https://en.wikipedia.org/wiki/Same-origin_policy) was the part that increased security, as it prevented websites (in browsers) from making arbitrary requests to arbitrary 3rd party websites. Cross-Origin Resource Sharing (https://en.wikipedia.org/wiki/Cross-origin_resource_sharing https://en.wikipedia.org/wiki/Cross-origin_resource_sharing) is one way to relax the Same-Origin Policy, so you essentially whitelist what actually can be shared across Origins. To be used when the default Same-Origin Policy is too strict. Overall I think it's a really simple concept, but libraries/frameworks/docs seems to constantly over-complicate it with their explanations.
- Lerc 4mo agoBut the combination of the two reduces security in the same manner as absurd password requirements cause people to write down their passwords. A strong security measure without a reliable way to do the things you want to do induces people to bypass the security altogether. Security designers generally are ok with this because they consider usability or user behaviour to be not their responsibility.
- TurdF3rguson 4mo agoIf you're hosting some 3rd party api that's safe to call client side then you send some header that says so. The problem is when it's not safe and devs try to bypass (a reliable way to do the things they want). The solution is to convince devs to not want to do those things.