We tested popular web hosting companies and all were easily hacked

Re:We tested popular web hosting companies and all were easi... by durbatuluk on Friday November 22, 2019 @08:57PM (#21611912)

I think everyone need to remember CORS is a browser-only protection and anything you expose via CORS protected endpoint in reallity has no protection at all. Try cURL reaching any endpoint protected by CORS and you'll see what I mean.

Also browsers automatic sending cookie enable many of these CSRF, consider JWT.

Amazing how PHP is still bitting developers.

[ Parent | on HN ]

Re:We tested popular web hosting companies and all were easi... by osrec on Friday November 22, 2019 @09:20PM (#21611991)

If you've taken the time to understand things well, you'll do just fine, even with PHP. Otherwise, the quirks of any language/library/tool may catch you out (it's not just a PHP thing).

[ Parent | on HN ]

Re:We tested popular web hosting companies and all were easi... by kyle-rb on Saturday November 23, 2019 @01:18AM (#21612762)

cURL being able to access a CORS protected endpoint isn't an issue because cURL doesn't have your cookies.

[ Parent | on HN ]