News for hackers. Stuff that matters.

A comment on CORS is not meant to secure an API endpoint. Parent comment

Re:CORS is not meant to secure an API endpoint by iakh on Sunday February 13, 2022 @10:44AM (#30322433)
There's a while saying dedicated to it, "lock them up and throw away the key".
[ Parent | on HN ]
Re:CORS is not meant to secure an API endpoint by pshc on Sunday February 13, 2022 @10:50AM (#30322521)
Hahah, alright. I'll grant you that. The lock:CORS metaphor was tenuous at inception, and now it is truly vaporized.
[ Parent | on HN ]
Re:CORS is not meant to secure an API endpoint by Dylan16807 on Monday February 14, 2022 @11:50AM (#30334235)
Notice how nobody ever does that with an actual lock. It's a metaphor for never letting them go free.
[ Parent | on HN ]