News for hackers. Stuff that matters.

A comment on Developers don't understand CORS.

Re:Developers don't understand CORS by jrudolph on Wednesday July 10, 2019 @03:47PM (#20405753)
CORS is a minefield. It doesn't help that the RFC is incredibly dense. I may be totally missing something, but I've repeatedly wondered though if CORS still has its place in times of SPAs that exclusively use xhr + javascript + some sort of auth token talking to a REST API?

Consider this argument: CORS basically ensures that browser and servers cooperate to protect end users from a "smart" user agent that happily throws around cookies and/or auth tokens. Remove cookies and basic auth headers, what's the point of CORS?

Happy to hear thoughts from folks more knowledgeable in web security than me. If not, let's please get together to propose an RFC for the CORS-GTFO header (a server header indicating that a browser does not have to do wasteful preflights etc.)

[ Parent | on HN ]
Re:Developers don't understand CORS by untog on Wednesday July 10, 2019 @03:56PM (#20405874)
> Remove cookies and basic auth headers, what's the point of CORS?

The ability to communicate with a domain other than the one your app is running on. For instance, if my site on www.example.com wants to send a POST to www.example2.com, I need CORS. example2.com needs CORS to specify that only example.com is allowed to send a POST to it, not anyoldaddress.com. example2.com could look at the Origin header and refuse connections, but it would be vulnerable to DDOS attacks.

Now, if your SPA is entirely self-contained and self-hosted then no, you don't need CORS. But there are plenty of situations where that isn't the case.

[ Parent | on HN ]
Re:Developers don't understand CORS by throwamay1241 on Wednesday July 10, 2019 @04:23PM (#20406128)
I don't think the act of sending the POST is blocked by CORS, receiving the POSTed response data is though.
[ Parent | on HN ]
Re:Developers don't understand CORS by disiplus on Wednesday July 10, 2019 @04:13PM (#20406034)
yup, i have a signup form on our website and that signup form calls ajax if the email is in use. without cors i would have to use jsonp or some other workaround.
[ Parent | on HN ]