News for hackers. Stuff that matters.

A comment on Ask HN: What do you use for authentication and authorization?. Parent comment

Re:Ask HN: What do you use for authentication and authorizat... by felipelemos on Thursday December 27, 2018 @02:04PM (#18771642)
CORS is not a tool to turn resources private, but to protect the browser (not the server's content) from cross domain requests.
[ Parent | on HN ]
Re:Ask HN: What do you use for authentication and authorizat... by scottydelta on Thursday December 27, 2018 @02:29PM (#18771841)
Exactly, the attacker can always not use the browser and emulate a browser request if motivated enough.
[ Parent | on HN ]
Re:Ask HN: What do you use for authentication and authorizat... by throwawaymath on Thursday December 27, 2018 @06:27PM (#18773589)
Yes, that's precisely why CORS is a poor fit for authentication :)
[ Parent | on HN ]
Re:Ask HN: What do you use for authentication and authorizat... by askmike on Friday December 28, 2018 @07:20AM (#18776350)
Sure, but I don't see why the tip in OP is "don't use CORS". To me that implies there is actually something insecure about using it.
[ Parent | on HN ]
Re:Ask HN: What do you use for authentication and authorizat... by throwawaymath on Friday December 28, 2018 @09:07AM (#18776755)
Yeah you can use CORS securely, there are just pitfalls to look out for.
[ Parent | on HN ]