News for hackers. Stuff that matters.

rojer_31

rojer_31 on Hacker News

Re:Cache your CORS on Tuesday September 20, 2022 @07:44AM (#32910404)
Scenario: In production where assuming ui.example.com is only for static resources/SSG and api.example.com is for dynamic api endpoints, we usually protect the api domain with WAF in CDN which will cost extra and typically unnecessary for the UI domain. So in this case by doing this reverse proxy, we will bypass the WAF layer or atleast feed WAF incorrect data (our server is requesting instead of the user directly). Since WAF usually has extra (significant) costs, what would you suggest in this case?