CORS is not meant to secure an API endpoint

Re:CORS is not meant to secure an API endpoint by Dylan16807 on Monday February 14, 2022 @11:43AM (#30334141)

> Which of those you conclude is a matter of semantics, and this interpretability contributes to the confusion around what CORS actually does. It's that confusion which another commenter was addressing [0] and that my comments sought to support/clarify. You may be unaware that some people believe that CORS is intended to "lock things down" vs. "open them up". They don't understand that it's opt-in or the default behavior without it.

Okay, sure, there's a semantics question and also some people are just confused.

So here is where I took issue: Yes, many confused people are conflating functionality and security. But while fivea/pshc's words might accidentally encourage that confusion, they were not confused, and were not conflating the two.

[ Parent | on HN ]

Re:CORS is not meant to secure an API endpoint by unclebucknasty on Monday February 14, 2022 @03:06PM (#30337529)

>while fivea/pshc's words might accidentally encourage that confusion, they were not confused, and were not conflating the two.

Probably more semantics. I don't claim to know what's in fivea/pshc's heads or whether they themselves are confused. I was speaking to my observation that their comments merged the two issues.

You may prefer phrasing like, "their words might accidentally encourage confusion" versus "conflation". I'd say conflation is the mechanism there, but OK.

Or you might prefer I specifically clarify "their comments conflated the two" vs "they conflated the two".

OK.

[ Parent | on HN ]

Re:CORS is not meant to secure an API endpoint by Dylan16807 on Monday February 14, 2022 @04:05PM (#30338346)

Here's how I see the difference: They made a definite distinction between the two, but if someone read too fast they might miss the distinction.

So their comments did not conflate, but might accidentally cause future conflation, so it's reasonable to reply to make the difference extra clear, but I don't think it's reasonable to accuse them of conflation.

[ Parent | on HN ]

Re:CORS is not meant to secure an API endpoint by unclebucknasty on Monday February 14, 2022 @05:05PM (#30339037)

Then it's not merely semantics. We legitimately disagree.

It happens. Thanks for clarifying.

[ Parent | on HN ]