News for hackers. Stuff that matters.

A comment on Ask HN: What's the recommended method of adding authentication to a REST API?. Parent comment

Re:Ask HN: What's the recommended method of adding authentic... by ssudaraka on Tuesday January 16, 2018 @06:17AM (#16157369)
Can someone fake the origin?
[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by fimdomeio on Tuesday January 16, 2018 @07:42AM (#16157751)
This is controlled on browser level and most (all?) browsers implement this. Origin can be faked by just using anything that can make a http request, like curl. It exists to protect users not the server.
[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by askthrowaway on Tuesday January 16, 2018 @07:46AM (#16157775)
from browser ? No. from non-browser clients like curl ? Yes. And your server will never be able to tell if it is fake or not
[ Parent | on HN ]