Re:Why does Google append while(1); in front of their JSON r...
by y0ghur7_xxx on Tuesday February 05, 2013 @08:26AM
(#5170498)
> Thankfully, CORS lets modern browsers go cross-browser
> safely, even with private data if things are configured right.
CORS does nothing to prevent CSRF attacks, see[1]. We still need to protect against CSRF.
Re:Why does Google append while(1); in front of their JSON r...
by facorreia on Tuesday February 05, 2013 @05:45AM
(#5170039)
"Thankfully, CORS lets modern browsers go cross-browser safely, even with private data if things are configured right."
Would you clarify or add some pointers to where we can learn about CORS benefits for private data? CSRF is a huge but often underestimated issue.
Re:Why does Google append while(1); in front of their JSON r...
by mmahemoff on Tuesday February 05, 2013 @09:14AM
(#5170696)
Actually as yoghur points out, CORS doesn't protect against CSRF. A token must be passed for any privileged calls.
That said, a benefit of CORS is the ability to do non-GET methods. So it's safer in the sense of HTTP idempotence, ie you can change server state safely, using POSTs, DELETEs, and so on. You'd still need to pass a token, however.
(Of course I meant cross-domain, not cross-browser :).
So a malicious website can't steal that content by putting the URL in a script. It will never get to see what's in the script and only a same-domain script could parse the whole contents, by making a XHR call, and strip out the "while 1;" part. In contrast, a regular JSONP string is specifically designed for the third party to read it (by including code to call a callback function).
A lot of people still don't realise you shouldn't be serving private data as JSONP. Thankfully, CORS lets modern browsers go cross-browser safely, even with private data if things are configured right.