4 ms·
Can't using CORS Allow-Origin headers solve this issue, if there's a domain for localhost and a valid certificate for it?
by dvirsky 12y ago
Can't using CORS Allow-Origin headers solve this issue, if there's a domain for localhost and a valid certificate for it?
- jorangreef 12y agoNot likely, as I think it will be blocked in the same way that mixed content is blocked (whether CORS is allowed or not). I think the plan is just to cut off access to localhost entirely whether intentioned or not, because WSS already has an Origin header which functions similarly to CORS when the client is a browser.
- dvirsky 12y agowhat I meant was that I think allowing CORS or a similar mechanism is probably enough, and breaking apps like Dropbox is not a great idea, even if there is a non standard mechanism to override it.
- jorangreef 12y agoYes I agree, and WSS already has that mechanism in place. A similar point was also raised in the issues thread but has not been responded to.
- justinschuh 12y agoAs I explained elsewhere, the origin header in WS(S) allows a server to overtly protect itself from a client. Unlike CORS, it doesn't allow the browser to make security decisions regarding requests, and so would not address any of the attacks we're trying to prevent.
- justinschuh 12y agoPotentially, yes, and it's one of the ways we're looking at addressing per-page opt-in.