News for hackers. Stuff that matters.

A comment on The Performance Cost of CORS Requests on Single-Page Applications. Parent comment

Re:The Performance Cost of CORS Requests on Single-Page Appl... by yomly on Sunday September 02, 2018 @01:01PM (#17897635)
Are you able to elaborate further on what attack vector you're thinking of (if only so I can google it) - JSON hijacking maybe?

The implicit assumption being that internally everything trusts the proxy?

[ Parent | on HN ]
Re:The Performance Cost of CORS Requests on Single-Page Appl... by graystevens on Sunday September 02, 2018 @01:26PM (#17897751)
I believe they are referring to proxying requests to third parties, rather than the first part of the post which refers to proxying to your own backend.

Proxying requests to a third-party will mean browser security features like CORS will assume they are entirely safe due to them appearing to come from your domain, and not “gist.github.com” etc.

[ Parent | on HN ]