News for hackers. Stuff that matters.

A comment on A proposal to restrict sites from accessing a users' local network. Parent comment

Re:A proposal to restrict sites from accessing a users' loca... by sidewndr46 on Thursday June 05, 2025 @09:32AM (#44191556)
This is also a misunderstanding. CORS only applies to the Layer 7 communication. The rest you can figure out from the timing of that.

Significant components of the browser, such as Websockets have no such restrictions at all

[ Parent | on HN ]
Re:A proposal to restrict sites from accessing a users' loca... by afiori on Thursday June 05, 2025 @11:49AM (#44192836)
A WebSocket starts as a normal http request, so it is subject to cors if the initial request was (eg if it was a post)
[ Parent | on HN ]
Re:A proposal to restrict sites from accessing a users' loca... by odo1242 on Thursday June 05, 2025 @12:25PM (#44193168)
Unfortunately, the initial WebSocket HTTP request is defined to always be a GET request.
[ Parent | on HN ]
Re:A proposal to restrict sites from accessing a users' loca... by hnav on Thursday June 05, 2025 @01:23PM (#44193756)
websockets aren't subject to CORS, they send the initiating webpage in the Origin header but the server has to decide whether that's allowed.
[ Parent | on HN ]
Re:A proposal to restrict sites from accessing a users' loca... by James_K on Thursday June 05, 2025 @11:36AM (#44192696)
Won't the browser still append the "Origin" field to WebSocket requests, allowing servers to reject them?
[ Parent | on HN ]
Re:A proposal to restrict sites from accessing a users' loca... by bstsb on Thursday June 05, 2025 @06:12PM (#44196250)
yes, and that's exactly how discord's websocket communication checks work (allowing them to offer a non-scheme "open in app" from the website).

they also had some kind of RPC websocket system for game developers, but that appears to have been abandoned: https://discord.com/developers/docs/topics/rpc

[ Parent | on HN ]