News for hackers. Stuff that matters.

A comment on CORS is not meant to secure an API endpoint. Parent comment

Re:CORS is not meant to secure an API endpoint by blurker on Sunday February 13, 2022 @12:54PM (#30323773)
Actually, I agree with OP. Grandparent's phrasing:

> All of this is completely wrong.

Is not only needlessly argumentative but also wrong itself. The 3rd point they include as "completely wrong" is not wrong, and they end up just rephrasing it later in their correction.

[ Parent | on HN ]
Re:CORS is not meant to secure an API endpoint by JimDabell on Monday February 14, 2022 @10:21PM (#30342328)
> The 3rd point they include as "completely wrong" is not wrong

It is:

> With cURL, no CORS takes effect, so the attacker has direct access with the full rights of the user.

The attacker has direct access with the full rights of the user because this is not a situation where one origin is making a request for a resource from another origin, so there’s nothing that says this shouldn’t happen. It’s got absolutely nothing to do with CORS at all.

[ Parent | on HN ]