News for hackers. Stuff that matters.

A comment on Demystifying CORS. Parent comment

Re:Demystifying CORS by rrosen326 on Monday June 04, 2018 @11:35AM (#17228812)
Aha - I think this answers something that has always confused me.

If I create a micro-service and want to protect it, CORS doesn't help me very much. I still need some sort of authentication mechanism (perhaps provided in a cookie) to say, "yes - this request is permitted."

CORS helps protect that authentication mechanism within a browser.

Is that about right?

[ Parent | on HN ]
Re:Demystifying CORS by jakelazaroff on Monday June 04, 2018 @12:26PM (#17229452)
Yup! CORS is meant to protect a service's users, not the service itself. Services should always authenticate/distrust user input/etc; no client-side technology makes that unnecessary.
[ Parent | on HN ]