Those examples are perfectly secure if you set the allowed origins to only your domains, or domains you specifically want to allow use of your API.
If someone copied those examples verbatim, they'd end up allowing a website hosted at example.com to call their API. Which I suppose is technically not secure, but I wouldn't call it very insecure unless example.com was taken over by a malicious user.
2 Comments
kvadd@lemmy.world · 3 pts · 59d
Interesting! He points to an article on how to implement a "very insecure" CORS policy, but not explain how to do it properly:
https://enable-cors.org/server_expressjs.html
So, how would a secure CORS in implementation look like?
doughless@lemmy.world · 1 pts · 59d
Those examples are perfectly secure if you set the allowed origins to only your domains, or domains you specifically want to allow use of your API.
If someone copied those examples verbatim, they'd end up allowing a website hosted at example.com to call their API. Which I suppose is technically not secure, but I wouldn't call it very insecure unless example.com was taken over by a malicious user.
webkitten@piefed.social · 3 pts · 59d