[dead]
Re:Show HN: BrowserBox – do stuff with browsers that you can...
by haswell on Saturday April 08, 2023 @12:17PM
(#35494760)
This sounds unrelated to the use case described by the parent, in which they want to serve specific files that exist.
But setting that aside, bypassing CORS to achieve this seems analogous to unlocking your front door/gate before leaving for the day in order to grant access to a delivery driver.
It’ll work, and the driver can deliver your package, but it’ll also let random and potentially malicious passers-by into your home without restriction, so who knows if your home will be intact when you return. A theoretically functional solution that doesn’t really work in the real world.
Some other solution that behaves more like a temporary file store sounds better, but the tradeoff I mentioned is specifically about CORS.
Isn’t this privacy tradeoff directly at odds with security? i.e. local access would also open the door to malicious sites accessing the local file system?
I can understand the dev-time frustration with CORS, but removing it just reintroduces a whole category of security issues.
Maybe there is something better, but whatever replaces it would need to include similar restrictions.