News for hackers. Stuff that matters.

A comment on Claude's API now supports CORS requests, enabling client-side applications. Parent comment

Re:Claude's API now supports CORS requests, enabling client-... by tommica on Friday August 23, 2024 @05:22AM (#41327451)
Simple, if you have an iframe pointing to http://foo.test/deletesite.php, without cors that request will be done, with cookies and everything, without the user being aware of it.
[ Parent | on HN ]
Re:Claude's API now supports CORS requests, enabling client-... by EE84M3i on Friday August 23, 2024 @05:29AM (#41327488)
AFAIKR you don't need CORS for framing, or making cross origin GET or POST. You only need it to read the response of a cross origin request and setting certain request header and body etc.

For example you can make a cross origin GET with an img tag, and a cross-origin POST with a form tag and some JavaScript.

[ Parent | on HN ]
Re:Claude's API now supports CORS requests, enabling client-... by Thorrez on Friday August 23, 2024 @10:00AM (#41329098)
You're correct.
[ Parent | on HN ]
Re:Claude's API now supports CORS requests, enabling client-... by Thorrez on Friday August 23, 2024 @10:00AM (#41329091)
That attack you mention is a CSRF attack. CORS doesn't really protect against that. That exact attack you mention is possible if foo.test doesn't implement CSRF protection. CORS doesn't automatically provide CSRF protection.
[ Parent | on HN ]