When I first learned about CORS, I had trouble understanding it because I couldn't figure out how this protected the server and I couldn't understand why you would do this just for the client 😄
One thing to note, CORS only makes sense if your API uses cookies for authentication, most APIs use custom headers, the Authentication header, or even url tokens, they don't rely on cookies, so most of the time, APIs don't care about CORS. People keep blindly repeating that accepting all origins "*", is bad for security, but the situations where this is relevant are really uncommon.
9 Comments
ryokimball@infosec.pub · 30 pts · 37d
Absolutely NOTHING! Good God, y'all.
univers3man@piefed.world · 4 pts · 36d
I get the reference
SorteKanin@feddit.dk · 1 pts · 36d
Enlighten me
ryokimball@infosec.pub · 1 pts · 36d
https://www.youtube.com/watch?v=hZJRJpbGkG4
ryokimball@infosec.pub · 3 pts · 36d
I deserve the downvotes, not even mad.
adhdsergio@lemmy.world · 12 pts · 36d
When I first learned about CORS, I had trouble understanding it because I couldn't figure out how this protected the server and I couldn't understand why you would do this just for the client 😄
cout970@programming.dev · 9 pts · 36d
One thing to note, CORS only makes sense if your API uses cookies for authentication, most APIs use custom headers, the Authentication header, or even url tokens, they don't rely on cookies, so most of the time, APIs don't care about CORS. People keep blindly repeating that accepting all origins "*", is bad for security, but the situations where this is relevant are really uncommon.
bitfucker@programming.dev · 1 pts · 36d
I wonder if XSS, CSRF and other client side attacks are still common
Swedneck@discuss.tchncs.de · 1 pts · 34d
protecting me from using my fucking browser, most of the time
jokro@feddit.org · 1 pts · 36d