Re:CORS is not meant to secure an API endpoint
by Xylakant on Sunday February 13, 2022 @09:24AM
(#30321902)
AFAIR it’s never the server that rejects the request in a CORS scenario: The server indicates what origins are allowed to call the API and the browser cancels the request on behalf of the user if called on a website that’s not on the allowed list. The server canceling the request based on a header would be insecure since the client can send arbitrary headers.
[ Parent
| on HN ]
Re:CORS is not meant to secure an API endpoint
by goto11 on Sunday February 13, 2022 @09:30AM
(#30321936)
JavaScript in an uncompromized browser cannot send arbitrary headers. See: https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_...
Otherwise a malicious site could just forge the Origin header in the preflight request.
Re:CORS is not meant to secure an API endpoint
by iancarroll on Sunday February 13, 2022 @09:44AM
(#30322007)
This is true, but there have been a lot of browser bugs in the past with Origin/Referer headers. Relying on those is not as foolproof as a CSRF token, which would require a more severe UXSS-type issue to leak. I wouldn’t advise it.