News for hackers. Stuff that matters.

A comment on CORS is not meant to secure an API endpoint. Parent comment

Re:CORS is not meant to secure an API endpoint by pshc on Sunday February 13, 2022 @08:18AM (#30321568)
If you have a lock with no keys, it's a non-starter; the door has no purpose. You'd be better off sealing the entrance with bricks.

If you offer a website with an API then CORS is an enhancement in that you're helping protect users from getting owned or hijacked. Alternatively if you can't stomach the risk, you could take down your API, which is about as useful as solving a math equation by multiplying both sides by zero.

[ Parent | on HN ]
Re:CORS is not meant to secure an API endpoint by casion on Sunday February 13, 2022 @10:08AM (#30322139)
"Lock with no keys" isn't particularly uncommon. They exist in the real world as one-way devices.
[ Parent | on HN ]
Re:CORS is not meant to secure an API endpoint by iakh on Sunday February 13, 2022 @10:44AM (#30322433)
There's a while saying dedicated to it, "lock them up and throw away the key".
[ Parent | on HN ]
Re:CORS is not meant to secure an API endpoint by pshc on Sunday February 13, 2022 @10:50AM (#30322521)
Hahah, alright. I'll grant you that. The lock:CORS metaphor was tenuous at inception, and now it is truly vaporized.
[ Parent | on HN ]
Re:CORS is not meant to secure an API endpoint by Dylan16807 on Monday February 14, 2022 @11:50AM (#30334235)
Notice how nobody ever does that with an actual lock. It's a metaphor for never letting them go free.
[ Parent | on HN ]