Some New HTTP Verbs

Re:Some New HTTP Verbs by blowski on Tuesday September 13, 2022 @09:40AM (#32824147)

I’m not sure CORS has failed. It’s forced a lot of teams to put internal apis on the same host, which is a security win.

[ Parent | on HN ]

Re:Some New HTTP Verbs by capableweb on Tuesday September 13, 2022 @09:47AM (#32824234)

Yeah, either putting the content + backend behind the same Origin, or just add `Access-Control-Allow-Origin: *` as a header to all requests (and the other ones), which one you think is most popular for people with no time to build things properly? ;)

[ Parent | on HN ]

Re:Some New HTTP Verbs by P5fRxh5kUvp2th on Tuesday September 13, 2022 @12:32PM (#32826544)

I agree with you, but there are those of us who push for putting everything behind the same origin and we succeed in that because most people are aware of how painful CORS is.

So, in some ways, CORS being so painful is actually helping (tongue-in-cheek, but it has some truth to it).

[ Parent | on HN ]

Re:Some New HTTP Verbs by blowski on Tuesday September 13, 2022 @12:33PM (#32826567)

With CORS we can choose from:

1. Apply more specific security appropriate for your use case

2. Put it on the same host

3. Origin *. Teams that do this probably have bigger security problems anyway.

Without CORS, we'd all be stuck choosing between 2 and 3.

[ Parent | on HN ]