Why do we have both CSRF protection and CORS?

Re:Why do we have both CSRF protection and CORS? by bastawhiz on Monday March 03, 2025 @10:03AM (#43242388)

Or make 10,000,000 Google searches through my browser and get my IP and account banned. Or process a request containing CSAM that has me reported to the government. Or using my residential internet connection to operate a proxy service, causing my IP's reputation to drop and now I'm stuck solving CAPTCHAs all day. Or, you make requests to lots of sites and see which ones have no responses: surprise! Now you know which websites I have cookies on. Why in the world would I want to let someone else use my device to make requests like that? Use your own device, not mine.

Fundamentally this all boils down to you, the person building the site, being cheap. You don't want to pay the handful of dollars to make your own HTTP requests.

[ Parent | on HN ]

Re:Why do we have both CSRF protection and CORS? by yoavm on Monday March 03, 2025 @11:33AM (#43243470)

Making 10m requests to Google, asking for a CSAM image etc are all currently possible with an <img> tag. This does not prevent it in any way. Allowing GET requests would be a very lame proxy service, especially considering that the proxy falls when you close the tab, and that I mentioned the requests should only be allowed cookie-less (credentials: omit).

I think it's much more about open web and letting the user decide than about being cheap.

[ Parent | on HN ]