Ask HN: Has CORS Solved Anything?

Posted by 02020202 on Tuesday October 06, 2020 @11:29AM
from the ask-hn dept.

Personally I see it only as something that needs to be implemented on the server so the browser doesn't error out and the user won't freak out. Beside that it's just like a lock on a door... in a house... with no walls.... in the middle of a desert... on mars.

( 4 comments | 12 points | on HN )

Re:Ask HN: Has CORS Solved Anything? by jamesjguthrie on Tuesday October 06, 2020 @05:08PM (#24702362)

It's a necessity that when implemented improperly leaves a sizeable security hole.

I recently got a bug bounty for finding a CORS vulnerability and showing a proof of concept phishing site that uses all of the resources from the genuine origin. The site was accepting a wildcard origin whereas it should've used a whitelist.

[ Parent | on HN ]

Re:Ask HN: Has CORS Solved Anything? by coolhand2120 on Tuesday October 06, 2020 @05:56PM (#24702771)

All I have to do is put a proxy in front of your API and strip all your headers off and send responses anywhere I like. Given that, how can CORS be "security"? It's totally insecure.

[ Parent | on HN ]

Re:Ask HN: Has CORS Solved Anything? by dylz on Tuesday October 06, 2020 @07:01PM (#24703440)

The point here is that if you put a proxy in front of your API, on your own infrastructure, _you are no longer in origin scope_ and cookies will not be sent along with the request.

[ Parent | on HN ]

Re:Ask HN: Has CORS Solved Anything? by iordachej on Wednesday October 07, 2020 @02:02AM (#24705688)

It is CORS that restricts running foreign javascripts in your page. Clearly a win

[ Parent | on HN ]