Developers don't understand CORS (2019)

https://fosterelli.co/developers-dont-understand-cors

by toilet • 1 month ago

388 268 1 month ago

piyh• 1 month ago

The only thing I remember about CORS is that it takes way longer than expected to debug, by design the error messages sent to the browser are intentionally gutted, and CORS error scenarios are hard to tell from other failure modes atfirst glance.

deathanatos2• 1 month ago

by design the error messages sent to the browser are intentionally gutted

A CORS error is not "an error message sent to the browser", it is an error generated by the browser, because the browser has decided it cannot permit the request. (Though certainly a server can not understand a CORS request as such, and returned a weird response, which would then end up getting translated to a CORS failure.)

ameliaquining• 1 month ago

I think what the person you're replying to is trying to say is that the web-accessible error message (i.e., the one that JavaScript running in the sending page can read) is intentionally opaque and somewhat misleading, because a more helpful error message would leak information about the response that the sending origin isn't supposed to have. There's typically a more helpful error message in the dev tools (which JavaScript running in a page can't access), but you have to know where to find it.

deathanatos2• 1 month ago

Generally when I'm debugging these, I need/want to know what was the preflight (if applicable), and was the preflight what was expected? When I help others debug these, generally I find there is little expectation of what the preflight "should" be, and instead just a bunch of stochastic attempts to adjust the server's response headers to get the browser to capitulate — regardless of whether that makes any sense at all.

I would also say I think Firefox's network inspector is better in this area. (But I'm often having to ask others to "no, don't send the failing request, send the CORS preflight", we need to understand what happened with it.)

Anecdotally, lots of developers I’ve talked with don’t understand well how CORS works.

Yeah, most FE devs I've worked with seem to not understand CORS.

Is the CORS API too complex and confusing

I think it can be hard if you don't understand why the exceptions to preflights are what they are, but the moment you internalize "because the browser can already emit that request in other cases" then it becomes obvious what categories are what & why.

jdw64• 1 month ago

Sometimes I'm not even sure what I truly 'understand.' When even senior engineers working on products used by hundreds of millions of people, like Zoom, have had these kinds of issues, it makes me wonder. So I usually just write code the way it was left by my seniors, out of inertia. But I realize that the area I work in is actually incredibly abstracted.

mock-possum• 1 month ago

I honestly just can’t be arsed. I write the code to do the thing I want, and if CORS throws a wrench into things, I make Claude fix it for me. I’m tired boss.

postsantum• 1 month ago

Good for you. It's the responsibility of the boss to hire someone to type "claude pls check if prorgam not safe"

trick-or-treat5• 1 month ago

, claude fixes it by doing insecure shit, your secrets end up exposed, you end up running a $10,000 api bill, you wonder how you got there.

throwaway73562• 1 month ago

Yes, many developers give nothing about even basic security.

That's why we still have every basic security issue like hardcoded passwords, SQL or other injections, XSRF and so on repeated on an endless loop. Even if they are trivial to avoid.

encomiast• 1 month ago

It's not just CORS that's hard to understand. Many (most?) developers don't really understand the threat model. And even when it's explained it hard to see why it's a big deal. Part of this is that backend developers usually have to configure CORS and it's not an access privilege protection. From the point of view of the backend it doesn't seem to matter. Bad guys can't get it. From the point of view of the front-end it's often seen as a nuisance.

The article does a nice job giving a concrete example.

cookiengineer• 1 month ago

On top of that, it's a threat model that doesn't make really sense from an attacker vs defender perspective. Because it's optional, and all kinds of other libraries and tools can just blatantly ignore it anyways.

CORS literally exists only against XSS and CSRF for actively logged in human users. Anything else in CORS is absolutely pointless because every other attack scenario uses scripts or programs that fake HTTP headers anyways. It's just as useless as the Sec-CH (client hint) headers because some Browser made by a company that starts with Micro and ends with Slop decided that the User Agent always needs to be Windows 10 for compatibility reasons.

That is why you see everyone just enabling every CORS option anyways, even though that is literally the worst case that allows XSS and CSRF. And a lot of websites have user edited content at some place, at the very least in images that aren't filtered for embedded scripts (PNGs, anyone?).

wonnage• 1 month ago

What else is there in CORS? It’s all basically a way for an origin to communicate to the browser which other origins it can share data with. Of course if there’s no browser involved then there’s no need for it.

Client hints are useful for all the shitty “responsive” websites that don’t know how to use media queries. And for ad tracking. Mostly the latter

yaur• 1 month ago

It’s not that hard to understand… in the cors threat model an attacker gets one your users to take an action on your site by visiting their site.

harrall• 1 month ago

It’s easy to understand but most people don’t naturally think of ways people try to break in. Without thinking about that, the importance of security is low.

It isn’t a knowledge thing (though it could be), or a capability thing, or intelligence. It’s pure mindset.

Ask yourself: is the average person noticing holes in fences and trying random doorknobs… probably not.

But on the other hand, most security people don’t think of product or UX (but some might) so that’s why you have roles.

hn_throwaway_99• 1 month ago

in the cors threat model an attacker gets one your users to take an action on your site by visiting their site

This is really oversimplifying things, incorrectly IMO, and that sentence makes it sound like you're confusing a CSRF vulnerability with CORS protections. Normally when you write a backend server you implement some sort of authentication and access control, and in that scenario the threat model that lets "an attacker gets one your users to take an action on your site by visiting their site" is a CSRF vulnerability, unrelated to CORS.

The scenario presented in TFA is actually a very special case, because the bug is with a webserver running on localhost that doesn't (apparently) implement access control - not something most web apps entail.

In fact, one of the parts that confuses a lot of people is that CORS rules only prevent the JavaScript web client from reading the response from a remote endpoint - if the endpoint is available on the public Internet then anyone can still make a request to it.

The other thing that is confusing about CORS is that browsers already let you load lots of resources from cross origin servers - you can load images (as TFA points out that Zoom did as a workaround), scripts, stylesheets, form submissions, etc. The one thing you can't do, unless the server implements the appropriate CORS headers, is make a cross origin fetch request from JavaScript.

ronbenton• 1 month ago

No? CORS is about preventing an unauthorized third party from _accessing_ data. That’s the meaning of “resource sharing.” If you want to prevent action-taking, there are other mechanisms. For example, using a header-based CSRF token if your auth scheme relies on cookies.

vachina3• 1 month ago

CORS is amazing for when you want to prevent people from (easily) stealing your bandwidth and hosting resources. Thieves have to stand up their own proxies, which makes them very easily blocked.

trick-or-treat5• 1 month ago

I think you're confused. The only thing blocked would be client side fetch. You need to find another way to protect everything else.

inigyou4• 1 month ago

How's it going with AI scrapers for you

mrweasel2• 1 month ago

We had a project were the same developer wrote the frontend and backend and still managed to get CORS wrong. As the operations people we rewrote them correctly in the load balancer... well I assume correctly, at least the application now works.

CORS is really hard to wrap your head around, but sadly there's also a ton of developers that not only fail understand the threat model that CORS guards against, they also don't understand webdevelopment in general, especially the http protocol. I find that somewhat strange, because they also can't do native application.

stephbook2• 1 month ago

I assume correctly, at least the application now works.

That's like saying the lock works because people can enter the building. What about keeping the bad guys out, which is the whole point?

confidantlake3• 1 month ago

they also don't understand webdevelopment in general, especially the http protocol. I find that somewhat strange, because they also can't do native application

Why would that be strange? Someone who is bad at thing A is likely also bab at closely related thing B.

torginus• 1 month ago

It's easy to get wrong, and CORS is not well suited to today's cloud-native microservice era, when your code calls into a million and one different api endpoints hosted by various means.

It used to be that there was a webserver which handled requests, and a static site server, which served the assets, sitting behind a LB connected to the HTTP address.

It made zero sense to do anything cross origin, and it was automatically suspicious. Nowadays, there's N services, all potentially talking to each other, making CORS very difficult to get right.

And more often than not, they are hosted on generic 'api aggregator' endpoints, which make it very hard to get CORS to do anything meaningful with regards to security.

Also, considering you can URL encode stuff, the part saying CORS prevents the exfiltration of data is not true, it just imposes an inconvenience tax.

paulddraper5• 1 month ago

Many (most?) developers don't really understand the threat model.

It’s because CORS builds on a very odd base permission model. So if you use multipart form data, okay. But application JavaScript bad.

frogulis• 1 month ago

From my experience, the reason CORS is hard to understand is that it's somehow inverted from the default "shape" of security in web dev.

We easily form the intuition of the client being a by-default untrusted entity, and checking whether it has the privilege of accessing this data, where the server is the arbiter of that access.

CORS is so inherently different to that, and while the information is easily available, it requires a short but careful read to grok the idea -- which a dev tunnel-visioning towards getting their application code written may not wish to slow down for.

trick-or-treat5• 1 month ago

I think that once you understand that CORS is about protecting the visitor not the server you're halfway there.

Also, if you have everything set up properly, the fact that you're haveing any CORS issues at all means you're probably trying to do something stupid and you need to ask someone smarter how to solve your problem.

dboreham• 1 month ago

The only thing to understand is that it does nothing useful today.

paulryanrogers• 1 month ago

Doesn't it help protect clients from malicious 3P JS?

At least so long as they don't have malicious extensions or a non-CORS browser?

kristiandupont• 1 month ago

What do you mean? It's a way to mitigate a certain attack vector and as far as I can tell, it works as intended given the circumstances it was designed under.

robertclaus• 1 month ago

I bet there's an awful lot of servers out there that will happily take CORS requests from any host because someone didn't understand why their second domain couldn't talk to the same API.

ChadNauseam• 1 month ago

That describes pretty much every server I've ever written lol.

ivanjermakov• 1 month ago

Sometimes it's a good thing when I try to use someone else's backend in my web app. For example map tile server or route builder, which are session-less and have no authentication.

The idea that HTTP servers are restricted to requests from a single domain by default is strange, wonder if CORS world be better off opt-in rather than opt-out.

kaoD• 1 month ago

wonder if CORS world be better off opt-in rather than opt-out.

It's necessary that the defaults are secure. More so, not less, if the problem is hard.

iririririr• 1 month ago

everything browser is about still allowing The Bad Thing Ad Companies need.

cors et al is a freaking mess because those things are designed by a comitee choke full of people who last promotion was their cool idea about how to monetize referrer, or how do cookie match across domains, or profile you with millisecond it takes to list your usb audio devices, or etc etc etc

preommr• 1 month ago

Because, like many things in web, it's a patchwork of compromises due to legacy issues, rampant inconcistencies and trying to be too clever.

You get results where it's really difficult intuitively understand it because at that point you're not really meant to. Realistically, people just follow a guide, or some lib, and move on.

koolala9• 1 month ago

CORS sucks since Cross-Origin-Embedder-Policy: credentialless was never made standard across all browsers. It's a browser client restriction you can't turn off. If you want to do anything interesting with WWW content you have to run your own browser or run an out-of-box one off a proxy server that breaks everything.

9dev8• 1 month ago

If you want to do anything interesting […] you have to run your own browser

This is usually a sign you don't really understand what you're doing.

koolala9• 1 month ago

Its not? Remember the 90s? There was a beautiful time before CORS and DRM in the browser. Browsers used to be something that actually cared about allowing full client control.

stephbook2• 1 month ago

I still don't understand the threat model and, obviously, it's not explained here either.

I log in to social.net. I click on scam.org and change sites. I'm on scam.org and it triggers a request to social.net/friends.

No cookies are sent, no JWT. I'm not logged in and get a "Needs login" HTTP error. Nothing bad happens.

I thought that's how it works without CORS already.

teaearlgraycold• 1 month ago

Cookies will be sent if SameSite=None. Because a lot of the web's security features were implemented well after the tech was popular it's a patch-work with lots of overlap.

abraham• 1 month ago

By default cookies are sent for cross-origin requests. The SameSite cookie flag that lets sites control this was only shipped in Safari the year before this blog post was written so it would have been hard to depend on it yet.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Coo...

inigyou4• 1 month ago

Your cookies are sent.

koolala9• 1 month ago

Then why wasn't credentialless a simple fix to solve that. Not sending cookies isn't hard.

rswail2• 1 month ago

CORS relaxes the rules about what requests the browser can make.

The server doesn't get to stop the browser making calls that it didn't want, so it's a browser security feature, to stop the browser sending cookies where it shouldn't, or more precisely, to only send authentication and other info where it should.

It relaxes the same origin policy.

Usually a browser will not load resources from another origin based on the HTML it receives. If the page is from example.com, it won't allow you to load a page from example.org.

That stops things like authentication and cookies etc from example.com being transmitted to example.org if someone hacks the webpage.

CORS allows the server to relax those rules so that it can say "You can load resources from me, or from these other servers."

So it can say "I'm example.com but you can load resources from example.org and that's OK."

At least, that's how I think it works :)

physix• 1 month ago

Developer's don't understand CORS

Count me in!

zdc1• 1 month ago

Even the HN comments here are a sea of confusion and contradiction.

It's stunning and makes me wonder whether CORS is a bad solution, or if it's solving a hard problem.

bazoom428• 1 month ago

CORS is counter intuitive. I don’t think there is a better way to solve the problem, it is just a difficult to understand problem.

CORS errors occur when JavaScript in the browser attempts to call a server which is not configured to allow it. But the check is purely client-side. You can circumvent it entirely by using curl or whatever outside the browser.

For example the server sends a header indicating which domains it allows requests from, but it does not actually check if requests are from those domains. It is the responsibility of the client to check its domain is allowed.

All this make it seem like a pretty useless security feature, unless you understand the very specific kind of attack this protects aginst.

Ekaros2• 1 month ago

Fundamental mistake was to build web like we did.

If you can run arbitrary code that can connect to other sites and make requests there someone will do that. And those calls can do exactly what they would on site. Only place to control this is the browser. Thus moving this decision to browser. One piece we probably trust way too much.

Live is simple when you directly communicate with one "server"(address) for one thing. Communicate with more. Well you never know if those others intended you to be able to do this.

And then when also all the authentication information lives in the browser too the mess is ready... So whole thing should have been build differently from start.

1dom2• 1 month ago

Your first sentence is the proof that CORS is a bad solution.

HN is supposed to be full of people who need to know, use and depend on CORS and CSP. We might all just be idiots, but we're the idiots who are supposed to use this tool, and we can't explain it or agree on it.

If a tool can't be used or understood by the primary users, IMO it's by definition a bad tool/solution. It's easy to see why - it's security that depends on a browser, something we're traditionally told never to depend on for security.

TeMPOraL9• 1 month ago

Problems:

- It has a name. That name was allowed to become more recognizable than that of the actual security mechanism (SOP).

- Once you use its name and start thinking of CORS as "the thing", most of DX is about CORS standing between you and perfectly reasonable, legitimate functionality you need to support.

- It does seem to put control in a weird place (backend telling a browser what it is or isn't allowed to do), and people seem to miss that this relies entirely on the browser itself being a compliant party you cannot control.

- I have my own, rather negative, opinions on the whole security model of the browser, that's strongly countercurrent (mostly about how it disenfranchises users), so let's just say here that this is indeed a hard problem being solved - so it doesn't help when people think of an exception policy as a security measure.

piterrro• 1 month ago

Wait, isnt it implemented because of the sheer number of broswers that could be used at the Zoom’s scale? They could’ve used jsonp too it they wanted to bypass CORS. Using image with different dimensions sounds like the most bulletproof way across multiple devices/OSes/browsers

ottoflux• 1 month ago

the amount of code i've seen either allowing * when it shouldn't because someone was desperately trying to make their code work is astounding.

contractors, "specialists", etc. who never took the time to read how CORS works and how simply you can handle a list of allowable sites, etc.

it's only complicated until you take the 5-10 minutes to properly understand what happens where. if you don't know, go do it now.

oofbey• 1 month ago

As somebody who has spent a lot more than 10 minutes trying to figure out why CORS was blocking what seemed legitimate, I sympathize with people doing the wrong thing, and disagree with your assertion that it’s not that complicated. Maybe I’m just slow. But objectively I know I’m not.

N_Lens• 1 month ago

“Objectively”

bornfreddy• 1 month ago

5-10 minutes? I'm sold. Any link you can share?

I'm saying this as someone who has learned about CORS protections many times, implemented the solutions with care they deserved, but forgot most of it soon after - each time. So I'd be very happy to invest even 15 minutes to break this cycle.

foundart• 1 month ago

Correct. Where are some good explanations?

kartoshechka• 1 month ago

- cors docs are written either from solution or implementation point of view, not the "why this exists, and how we successively deal with bad actors trying to game cors", cors RFC is terse

- protocol itself is quite nuanced, like iirc requests with Authorization (or some other) headers don't obide by usual rules, and again for developer it's just an arbitrary convoluted set of rules, if they don't grasp the problematics

- backend and frontend should work in unison to have correctly configured cors, but as we know, devs hate communicating with each other

supriyo-biswas• 1 month ago

I wish more people read the CORS article on MDN[1] which helped me a lot at the time when I was trying to understand it. I knew some people had trouble with CORS but had no idea it was this bad, going by the comments here.

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/COR...

nedt• 1 month ago

Exactly this. I can only upvote you once, but this is one article that should answer all the questions. Not just the simple origin case, but also how a preflight works.

ozim• 1 month ago

Issue is that for most projects CORS is set and forget. You don’t run into it once a month or even once a year - you run into it when setting up new project from scratch.

Many or most developers work on existing projects that have all kinds of security defaults set somewhere in the past and no one bothers reviewing those.

PunchyHamster3• 1 month ago

Nah the clowns at standard board just decide to fuck shit up every few years and add some new mess to CORS that breaks in some subtle edge case on existing setup

muvlon2• 1 month ago

Even TFA seemingly doesn't understand CORS. Or at least misreprents it grossly:

The webserver listening in on localhost:19421 should implement a REST API and set a Access-Control-Allow-Origin header with the value https://zoom.us. This will ensure that only Javascript running on the zoom.us domain can talk to the localhost webserver.

No, that does not do that. JavaScript from any other website can still talk to localhost:19421 just the same. CORS doesn't restrict anything, it loosens the default set of restrictions (ignoring preflight requests for now and assuming we're talking just about "safe" Methods). That Access-Control-Allow-Origin header just allows JavaScript running on zoom.us to read the responses when it queries localhost:19421. The requests happen in any case, and you must ensure in your backend that they don't cause any adverse effects.

Lerc2• 1 month ago

I don't think you can even say CORS does that.

The degree to which CORS is poorly understood (I have read numerous (often contradictory) documentation and I don't really understand it.) means that you can't rely on it being implemented properly by an unknown party,

If a protocol reaches this level of widespread confusion, I think all bets are off. Even if one end of a system performs correctly, who's to say that the other will. If people adapt their code until it works with another implementation, were they mistaken, or the other end?

RobotToaster• 1 month ago

It seems like nobody understands CORS.

Including me TBH.

xg1511• 1 month ago

I think it still works, because the number of "client implementations" of CORS is very limited (*) - only the browsers have to implement that, and the browser devs seem to understand it well enough.

So there is only one end of the system that is confused - the servers - but at least the other end - the browsers - can mostly be trusted to implement it correctly.

(*) unless you're implementing an open proxy, but then you have bigger problems.

spl757• 1 month ago

A poorly documented, poorly implememented, and poorly understood protocol is a worthless protocol. More than that, it's a potential attack surface, and the idea is to reduce those. If you are the admin of something, and you are putting things into production in which you don't fully understand the implications, because you copy/pasted some crap from stackexchange assuming the person that posted it knew what they are talking about, then you are doing it wrong. Just look at this thread. It's chaos and reinforces the fact that even people that think they know, don't really know. When in doubt, grab the RFC and figure it out.

SahAssar• 1 month ago

assuming we're talking just about "safe" Methods

That's a pretty big assumption. Any decent webdev should not let GET/HEAD/OPTIONS modify state (joining a meeting is changing state) and additionally PUT/DELETE should also be idempotent.

POST with JSON (or other non-form formats) api's should also have it's content-type header checked (text/plain forms can send a JSON body but the content-type will be text/plain). PUT/PATCH/DELETE and POST with a non-form content-type (application/x-www-form-urlencoded, multipart/form-data, or text/plain) will trigger a preflight so that CORS is properly checked before the actual request reaches the server.

bwblabs2• 1 month ago

Any decent webdev should not let GET/HEAD/OPTIONS modify state
additionally PUT/DELETE should also be idempotent

Yes, but I think the majority of large web applications are not fully correct in terms of 'Safe and Idempotent Methods' (https://datatracker.ietf.org/doc/html/rfc9110#name-common-me...).

bwblabs2• 1 month ago

Another quote from the article:

Further, native apps can generate a unique self-signed certificate.

Just creating a certificate will not work, unless it's installed as root CA certificates in all browser trust-stores on the machine. And if the private key of the root CA is not secured correctly, one could MitM any websites. So at least you want it name constrained (https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1....), but at least in Chrome until 2023 (v112) that did not work on root CA's (https://alexsci.com/blog/name-non-constraint/), so you had to add an intermediate CA and add the constrain there. Of course, you should also just throw away the key of the root CA.

I will admit I once added basic constrains in some project with a local root CA (2020-2022), but 'incorrectly' to the root CA, and did not test it in all browsers.

xg1511• 1 month ago

(ignoring preflight requests for now and assuming we're talking just about "safe" Methods)

You can't ignore those because they constitute the bulk of CORS' security model.

Yes, you're technically right that CORS cannot prevent other websites from making any request to your server - this would be impossible, since the browser somehow has to get the CORS headers in the first place.

However what CORS absolutely lets you do is prevent requests to particular endpoints - and you can then design your API in such a way that the dangerous actions are only available behind those endpoints and thus make it safe.

I.e. what's missing in the TFA quote is that the server must also change the endpoint from GET to POST (in addition to setting the CORS headers) and remove the GET endpoint. Other websites would still be able to send a GET or a preflight OPTIONS request, but they wouldn't be able to send the actual POST request.

As such, Zoom's workaround had two problems: They didn't set any CORS headers, which prompted the browsers to only allow "safe", i.e. GET requests - and then put an unsafe action behind the endpoint, therefore violating the "safe" assumption. Moral of the story: Don't put actions that do something else than returning a result behind a GET request.

Beltiras3• 1 month ago

Every ad GET is doing a lot of things that violate that edict.

z3t4• 1 month ago

Importantly it only prevents clients that actually cares about the cors headers. Like ohh I'm from hacker.org and the http headers says it only allows zoom.us ohh nooooo. Like it's just a http header! Now if you use a mainstream browsers and you accidentally visits hacker.org in a iframe at some shady site - then the cors header will prevent your browser from accessing it.

paulddraper5• 1 month ago

It is widely assumed by users that web browsing is safe.

If a browser does not implement CORS protections (but allows cross-origin requests), then its users must have non-standard expectations about security.

Sophira8• 1 month ago

My understanding was that "preventing otherwise disallowed HTTP requests" was the entire point of the preflight OPTIONS request, and that CORS will do nothing if the request would otherwise be allowed.

For example, a POST request with a Content-Type of "text/json" would not be allowed to be sent to third-party hosts without an OPTIONS preflight, but one with a Content-Type of "multipart/form-data" would be allowed and wouldn't be stopped by CORS at all, even to third-party hosts.

(And, of course, if your endpoint just assumes JSON without strictly checking the Content-Type, then congratulations, you've just allowed any website to POST to you, with no user action required.)

xg1511• 1 month ago

(And, of course, if your endpoint just assumes JSON without strictly checking the Content-Type, then congratulations, you've just allowed any website to POST to you, with no user action required.)

Is that so? Neither urlencoded forms nor multipart/form-data are valid JSON on the wire, so while other websites could send requests, wouldn't they just hit a parse error?

stymaar4• 1 month ago

I don't understand why this is the most upvoted comment. OP is right, and you are wrong.

The requests happen in any case, and you must ensure in your backend that they don't cause any adverse effects.

GET requests will be sent, but they are supposed to be idempotent so if your server is implemented in a sensible way, it cannot cause any adverse effect, and reading the response is all that matters for GET requests.

For non-idempotent requests however (the only ones that are supposed to be able to have side effects), a preflight OPTION request will be sent in cross-origin context instead of sending the request itself. And unless the right headers are set in the OPTION response, the request won't be sent at all.

Sophira8• 1 month ago

That's not quite correct. POST requests with certain Content-Type headers, such as text/plain or multipart/form-data, will still be allowed without any kind of preflight. If the web application doesn't check the Content-Type header strictly, then you've got a problem.

muvlon2• 1 month ago

We are saying the same things, just expressing them in different terms. Yes, only idempotent methods and "safe" POST requests don't need preflight. And I'm saying you need to make sure in your server implementation that those are actually safe. The article states that the CORS header will prevent random other websites from talking to localhost at all, which is just wrong.

ksbd-pls-finish• 1 month ago

GET requests will be sent, but they are supposed to be idempotent so if your server is implemented in a sensible way, it cannot cause any adverse effect, and reading the response is all that matters for GET requests.

Just my first thought as a security engineer, but sounds like a perfect opportunity to execute a timing attack to me. For example, vheck which users exist (by measuring response time for /api/users?name=john) etc

JimDabell7• 1 month ago

GET requests will be sent, but they are supposed to be idempotent so if your server is implemented in a sensible way, it cannot cause any adverse effect, and reading the response is all that matters for GET requests.

This is not correct. Safety and idempotency are two different concepts. Safety is when a request does not result in a state change. Idempotency is when the outcome is the same whether you make the request once or several times.

GET is defined to be both safe and idempotent. Clients can make GET requests without explicit human intent driving them because they are safe, not because they are idempotent.

DELETE is not defined to be safe but it is defined to be idempotent. This means you need human intent to drive it, but clients can retry as much as they like because whether you ask to delete a resource one time or a hundred times, the result is still the same – the resource is deleted. Obviously making DELETE requests can result in adverse effects even though it is idempotent.

POST is neither safe nor idempotent, however it’s subject to some unintuitive rules when it comes to things like cross-origin requests for historical reasons.

w29UiIm2Xz• 1 month ago

I encountered many a web service that do not use HTTP verbs correctly.

bazoom428• 1 month ago

You are kind-of both right. The spec defines a subset of cross-domain requests called “simple requests” - basically such requests as has always been supported by a plain html form. These are not affected by same-origin or CORS. So you can post url/form-encoded data to a different domain - but you cant access the response.

But CORS affect all other requests, e.g POST using JSON or XML content type, and all other methods like PUT, DELETE, PATCH.

So you can do an unsafe POST using form-encoded data, but if a server supports this, they hopefully mitigate CSRF, since this has always been a risk.

827a• 1 month ago

if your server is implemented in a sensible way,

lol

J-Kuhn• 1 month ago

You can do GET & POST requests without preflight.

The logic behind this is: It was possible to do this before the introduction of those APIs anyway - but you could not read the response.

You could send a GET request by, for example, embedding an image. And you could send a POST request by submitting a form - even if the form did only consist of hidden elements.

Those are called "simple requests": https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/COR...

It is expected from web application that they can correctly handle those requests, even when they were sent from a different origin (for example, blocking them by using a CSRF token).

It was however not expected that existing web applications could handle non-simple requests - as the ability to do so was restricted either to command line tools or required other user interaction/configuration. This is where the preflight request comes in - send an OPTIONS to check if the other side is okay with that kind of request.

But what CORS do is: It can make the response available to the requesting script - the request did already happen if it didn't require a preflight.

dataflow• 1 month ago

You're confusing "idempotent" with "pure", I think.

bazoom428• 1 month ago

“Can still talk to, but cant read the response” is a bit too simplied. You can’t post a json payload for example, which is how a JavaScript client would usually talk to a backend. You can only post using form data encoding, since this is already possible using a plain html form without any JavaScript. Anything beyound that, like json/xml payloads or methods other than post and get are blocked by default.

paulddraper5• 1 month ago

> This will ensure that only Javascript running on the zoom.us domain can talk to the localhost webserver.
No, that does not do that.

It restricts non-zoom.us domains to CORS-safe operations.

Which sometimes includes making the request, sometimes includes reading the response content or headers.

mparnisari• 1 month ago

I'm one of them. CORS is THE topic that I have to get a refresher for periodically. It's like I forget about it, it never sticks. I'm a backend developer so I never encounter any cors issues. Maybe that's why? I seem to forget things that I don't use on a day to day basis, so.

yen223• 1 month ago

The biggest problem with CORS is precisely that most CORS errors show up as a frontend problem - specifically, a browser problem - but it needs to be fixed on the backend

cyberrock• 1 month ago

The DX for CORS and CSP is horrible because none of the browsers point out where the problem is coming from. In a sane world they would all write "response header" or "meta tag" somewhere in the message but the Riddler, Jigsaw, the Cheshire Cat were each hired by the major browser vendors to write the error messages. Chrome is the closest with "requested resource" but that's still downright cryptic. But on the other hand I'm glad all three of them still agree on something.

Edit: I realize that this is a fairly non-constructive comment, so to fix that, my suggested replacements are:

    Resource https://bank.com doesn't allow cross-origin requests due to lack of CORS headers. (Link to preflight request in Network tab) CORS protects against unaffiliated sites requesting data from your server. (Link to MDN)

    Resource https://bank.com doesn't allow cross-origin requests because this origin isn't in its CORS allowlist. (Link to preflight request in Network tab) ...

    Resource https://... can't be fetched due to CSP headers in this page. (Link to page request headers or meta tags in inspector) CSP prevents unauthorized scripts from executing on your page. (Link to MDN)

1dom2• 1 month ago

I feel the same. Unfortunately, I've had to deal with CORS in a few situations where the request is "we need to get this thing from this server, but we can't change the servers CORS or CSP", which, in technical security speak is "we have this security system in place, we need to circumvent it".

Ultimately, it almost always depends on the server only being accessed via an untampered browser request.

The Zoom exploit was able to happen because CORS and CSP are so easy to get around on the client side, so Zoom did it. Sure, Zoom were bad/lazy/silly for doing it, but I feel we're bad as a community for still having this model.

rishabhpoddar• 1 month ago

I agree that CORS is hard to understand and fix. I was the CTO at an auth company and SO many of our users used to run into various CORS issues and asked questions on our support. However, I'd now argue that developers don't need to understand CORS anymore.. cause claude / gpt does! Just throw in the error in claude code / codex and it would fix it.

gum_wobble• 1 month ago

developers don’t need to understand X … cause claude does!

…………………

stephantul• 1 month ago

The second part of this comment is not what I expected. I also don’t think it is true. I got bit by a CORS error at work recently that passed by Claude, copilot, and another senior engineer.

sourcecodeplz• 1 month ago

damn where are we heading?

9dev8• 1 month ago

It's astounding how willingly people give up their agency. Dystopic sci-fi novels turn out to be bogus, because nobody will rebel against the machines if it prints funny progress indicator words to the terminal

Keyframe• 1 month ago

Start learning security, this will be a great career going forward!

somat• 1 month ago

It's me, CORS was the stupidest thing I encountered in a long line of stupid when trying to put together a simple web app for the first time.

"So let me get this straight. We tell the client whether the application we gave them can or cannot make requests to our servers. And none of this actually prevents the client from making the requests if they want to?... Pull the other one it has bells on."

It took a good sleep and a long shower to under stand it. "Oh... it is for if I want to do a self injection attack and allow random untrusted malicious code in my application. In other words, ads"

Basically the threat model is inverted from any other threat model, that is why it looks so stupid. CORS is threat model used for when you can't trust your self.

gf000• 1 month ago

Well, it's easy to "not trust yourself" when you have user-submittable content that you display for other users. Sure, one should absolutely sanitize it, but layered security is important.

sciencejerk• 1 month ago

Eh, or maybe you landed on a malicious site or clicked on a malicious phishing link which opened your browser

throwaway73562• 1 month ago

CORS is threat model used for when you can't trust your self.

No. But many lack basic understanding of web technologies or facts like that a browser can be used to access more than a single site. This leads to not understanding what problems cross-site requests can cause and thus the impossibility of understanding what CORS is for.

thomask1995• 1 month ago

I think some sort of gui to help write the cors headers would help tbh.

it's quite difficult to get your stack to work for local dev, CI, and prod since each most likely needs different cors headers. Especially if you use tunnels and proxies like we do.

What made it click for me though was understanding what problem it solved.

d--b• 1 month ago

A CORS protected endpoint tells YOUR BROWSER not to let YOU access its content if the website you’re browsing from is not whitelisted.

It’s confusing because unlike most security features, it’s meant to protect the users from themselves. The risk comes from a combination of users being allowed to visit malevolent sites and browsers letting all websites do a lot of random stuff, including making 3rd party requests with cookies and private stuff

user43928• 1 month ago

Isn't it arguably the opposite?

A CORS header in the response tells your browser to relax CORS restrictions.

IceDane• 1 month ago

Like the sibling said: CORS is the relaxation of default security features. It's even in the name: Cross-Origin Resource Sharing.

koolala9• 1 month ago

'No Sharing' is a policy on sharing. Being literal about the name misses their point.

moring2• 1 month ago

it’s meant to protect the users from themselves

This is false. It is meant to protect users from a confused-deputy attack made by malicious websites, where that website makes a request to a "serious" API but the user has never asked for, or approved, that request.

Blaming the user for everything that happens serves nobody.

kittywantsbacon• 1 month ago

[flagged]

ghoshbishakh• 1 month ago

100% - although it is stunning to see since most LLMs get CORS questions right (which is surprising since they trained on all sorts of incorrect data).

Finbel• 1 month ago

Maybe it’s like that trick where if a thousand people guess the amount of beans in a jar almost all of them will be wrong but their average will be very close to, if not, correct.

tgv• 1 month ago

I think many (most?) have preferred sources. I would weight Wikipedia and MDN higher than Snurk Grubble's blog in training, no matter what the topic.

PunchyHamster3• 1 month ago

It's probably trained more on fixes on incorrect CORS than the problems

mhh__• 1 month ago

They look for latent structure in the data.

gib444• 1 month ago

Guidelines say to edit out swipes, so your comment can be edited to just:

paulddraper5• 1 month ago

Depressing.

While CORS is not intuitive, it is understandable by RTFM.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/COR...

JimDabell7• 1 month ago

I think perhaps it’s generational.

If you were a web developer before CORS existed, then you understand that cross-domain requests were forbidden all along and CORS was created to bypass this security. Therefore to do the thing you want to do, you need to enable CORS. No problem, that’s pretty easy.

If you only picked up web development after CORS existed, then you try to make a cross-origin request; the browser understands that it isn’t allowed; the browser tries to do a CORS preflight request; the preflight request fails; and the browser reports a CORS error in the console.

So if you don’t understand what’s going on, don’t RTFM, and just guess, you’re going to guess that CORS is the thing that is blocking the request and that you need to disable CORS. And that leads you directly into a confusing mess because you are trying to do the exact opposite of what you need to do. CORS is the solution to your problem, not the cause of it.

It doesn’t help matters that a whole bunch of people with the same misunderstanding will confidently repeat that misunderstanding in tutorials and online discussions.

brazukadev2• 1 month ago

So if you don’t understand what’s going on, don’t RTFM, and just guess, you’re going to guess that CORS is the thing that is blocking the request and that you need to disable CORS. And that leads you directly into a confusing mess because you are trying to do the exact opposite of what you need to do. CORS is the solution to your problem, not the cause of it.

Great explanation. The name is quite obvious actually, Cross-Origin Resource Sharing. People should understand if they read it.

jkrejcha• 1 month ago

Gonna play devil's advocate here

I think to some extent CORS and SOP are a bit equivocated somewhat intentionally... i.e. CORS is a used as a shorthand for SOP because CORS is a more well known term, especially in its acronymized form.

Consider for example the error I get when opening up the console on Google's homepage

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://play.google.com/log?format=json&hasfast=true. (Reason: CORS request did not succeed). Status code: (null).

There is a reference to the SOP in here but it starts off with "Cross-Origin Request" and also says "CORS request did not succeed". Which makes it sound like CORS is the problem or the thing doing the blocking or that "CORS" is enforcing the "Same Origin Policy". Chrome, I've heard, is even more cryptic

Also, it feels like one of those things that are a little pedantic to mention in a discussion irl, so that's probably why the term CORS sticks and the term SOP doesn't

Izkata3• 1 month ago

If you were a web developer before CORS existed, then you understand that cross-domain requests were forbidden all along

They weren't though. We had to adjust in the 2010s so existing code wouldn't break. It was something like, Chrome set a deadline after which it would be forcing the same-origin security by default, where it was off or optional before.

ralusek2• 1 month ago

I understand CORS and I don't.

TL;DR: It's a restriction your browser gives itself. If it's on Domain A and it sees a request going out to Domain B, unless Domain B responds saying that it's expecting traffic from Domain A, the browser prevents itself from making the call.

I think the part about it that is off/silly to most people is that it's not a normal security threat model, because a malicious client could simply just...not impose that restriction on itself. You're perfectly capable of going and curling that same request to that backend, or calling it from an app, or any number of other things. So it's not really protecting your protected resource, the backend, from malicious clients.

All of that is where I feel like I understand clearly. The part I fail to retain is the exact scenarios it does protect against, which IIRC, are basically about attempting to protect your users from being misguided on other clients that are acting as your client, something like that (but again, this literally only applies to browsers). It's just kind of a weird niche problem that I often find myself thinking "I mean why is the user on another client and have allowed themselves to authenticate on that client with my server...this sounds like the user's fault."

eurleif2• 1 month ago

The part you may be missing is that cookies exist.

User visits A.com, types in their username and password, and a cookie is set in their browser. The browser will send that cookie back to A.com with all subsequent requests, and A.com's server will use it to enable access to the user's account.

Now the user visits B.com, which makes a request to A.com/private_user_data. The user's cookie is sent with this request, so A.com will respond with (and B.com will receive) the user's private data without the user consenting to this at all (not even in a "misguided" way).

xigoi• 1 month ago

Why not just not send cookies instead of blocking the request completely?

9dev8• 1 month ago

[…] the browser prevents itself from making the call.

That's not strictly correct, by the way. The request is made, but the JavaScript code on Domain A is not allowed to read the response. This matters when a request is destructive on its own, for example.

eurleif2• 1 month ago

To go even deeper into the weeds: this is only true of "simple" requests[0]. Requests that aren't "simple" always require preflight approval. This is based on which requests a <form> or link could already create without approval; since the dawn of time, <form method="post"> could submit a potentially-destructive request, and sites needed to protect themselves against that via XSRF tokens; so CORS could allow submiting the same class of requests without preflight approval, and not introduce any new attacks. But there's no <form method="delete">, for example, so CORS would have created attacks against previously-secure sites if it had allowed DELETE requests without preflight approval.

[0] https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/COR...

ralusek2• 1 month ago

My understanding was it was an OPTIONS preflight request that is made.

rusk• 1 month ago

It’s TOS for using ebdpoint. It says:

access is provided under condition you respect these restrictions

You are not obliged to honour this. It is not enforceable so it seems strange.

Browsers enforce it, but it can be turned off and nobody expects it to be implemented by a simple REST client application.

It’s a gentleman’s agreement. It’s a statement of expectation to the browser. On the one hand it may be for the protection of the browser user, from cross site attacks, and from malicious code on the web.

But crucially it provides little protection for the endpoints themselves bar accidental misuse.

It is very unusual and rare example of “cooperative” security in a web that’s frequently so adversarial.

And that’s what makes it hard to grasp.

9dev8• 1 month ago

Browsers enforce it, but it can be turned off and nobody expects it to be implemented by a simple REST client application.

No, you're missing the point. Normal people using normal browsers with default settings have CORS enabled. That's the vast majority of your users; everyone who disables it stupidly opts into a risk themselves without any reason to.

So the expectation that CORS is enabled on your user's devices holds. This means it's not a gentleman's agreement!

himata41133• 1 month ago

It was pretty amusing reading the comment section so I'll chime in: SOP protects you (the browser) from leaking information to websites that should not be able to access that information and CORS allows you to weaken it.

Example: SOP stops example.com from fetching the list of subscriptions on youtube.com. But CORS allows example.com to access youtube.com/public/*.

This is also not the sole use-case, it also stops your backend api being up under a different frontend which would allow data theft since you could log into real services on google.com, but you're actually on g00gle.com enabling data exfiltration because now every request can be MitM'd.

crackalamoo• 1 month ago

I love this, easy intuitive explanation

StrauXX2• 1 month ago

No, it's exactly the other way around. The SOP protects you from these security issues. CORS is a feature that can be used to loosen up the SOP, to allow more complex inter-application behaviour.

himata41133• 1 month ago

ah right, my own brain got jumbled from reading all the comments forgetting that cors: '*' is not the default.

flux3125• 1 month ago

And now he's part of the confusing comment section lol

krackers• 1 month ago

To understand the threat model you need to understand historical decisions browsers made, such as when cookies are sent, and the distinction between actually sending the request versus allowing client-side JS to read back request content. The decisions are just really counterintuitive and often build on legacy precedent.

I think the nature of threat model has also changed over time. Now that samesite cookies are the default, API requests made with the user's credentials shouldn't be an issue, but there is still value in preventing cross-origin reads to do things like preventing random webpages from scanning intranet (there are probably still timing side-channels though). I guess the limitation against non-simple post/get is also marginally beneficial for preventing ddos.

drchaim• 1 month ago

I understand CORS each time I need to fix or to avoid them ;)

StrauXX2• 1 month ago

This blog post is very misleading.

So what would a secure implementation of this feature look like? The webserver listening in on localhost:19421 should implement a REST API and set a Access-Control-Allow-Origin header with the value https://zoom.us. This will ensure that only Javascript running on the zoom.us domain can talk to the localhost webserver.

First of all, its not CORS that protects. CORS is an anti-security feature. What does protect is the SOP (same origin policy). The SOP (or SOPs rather, it's not really one feature but more of a paradigm in the standards) blocks documents from one origin, from reading data that belongs to another origin. This is the reason why `let w = window.open("https://example.com"); console.dir(w.document.body);` will work when it is ran from example.com, but not wikipedia.org. Only when protocol, host and port match, can documents access each others data (there is an interesting differential with cookies here, their SOP only looks at protocol and host, not port).

Importantly, the SOP only blocks reading data from other origins, not writing! So while example.com won't be able to read the response of a post request it sends to wikipedia.org, the request is sent and processed nontheless!

CORS now is a feature that allows sites to loosen up the SOP. This allows documents to read cross origin data nontheless. Namely, HTTP responses. (Standards for reading other kinds of data cross origin exist, but are not related to CORS).

utopiah• 1 month ago

I definitely understand CORS in theory, then when it's time to solve a CORS related error, anything goes. /s

Izmaki• 1 month ago

I don't fully understand CORS and was hoping he'd explain how it works. :(

rubendev• 1 month ago

This is really a self inflicted problem. If you host your backend on the same origin as your frontend (using a reverse proxy) you don’t need CORS at all and you can use the vanilla SOP, and strengthen it further with a strict CSP.

ricardobeat• 1 month ago

It really is architecture dependent. There are many valid reasons why would not want to route all API requests through your frontend infra, or vice-versa.

rho138• 1 month ago

People hating on web developers and/or saying application developers are better and then everyone bombs the RFC challenge.

karol• 1 month ago

CORS, CSRF and CSP get the job done;)

theginger• 1 month ago

Cors is hard to understand because the browser is protecting you and the server from malicious code that the developers are not expecting to be there. Its a hypothetical threat you cannot see during development unless you really go out of your way. If you can't see the threat it's hard to understand it, it you don't understand the threat it's hard to understand the protection against it.

Its one of those situations where you need to think like an attacker to see the whole picture.

threethirtytwo• 1 month ago

AI understands CORs. So that's something AI does better than developers.

lofaszvanitt• 1 month ago

Because they don't like reading docs. At the same time it is an overcomplicated fucking mess, just like CSP headers just like css syntax/wording. Somehow everything that is security related is overly complex.... it's a miracle!

brazukadev2• 1 month ago

the browser security model is quite efficient and heavily tested tho.

xg1511• 1 month ago

CORS seems to be the Offside rule of the webdev world.

I wonder if much of that misunderstanding comes from the threat model being quite unusual and not always easy to understand.

For starters, there are three parties, which all don't trust each other: The server, the browser and the JavaScript running inside the browser.

The browser is supposed to protect the server against requests from unauthorized JavaScript applications. CORS is there to mark certain requests as "authorized", while keeping the protection active for the rest.

But the entire system only works if those three components exist in the first place, as enforcement is solely relying on the browser.

dofm• 1 month ago

Part of the issue is developers imagining a theoretical solution to a wider problem than CORS is trying to solve.

Once you understand that it's onlying to solve problems that happen in a user's compliant browser, and not some wider issue of resource authorisation, it does get a bit easier to understand.

Though in a way CORS seems too simple for what it achieves.

confidantlake3• 1 month ago

I thought I knew CORS before but after reading all the comments I don't think I know anything anymore. Guess I will just make a coffee and move on with my day.

ktzar• 1 month ago

it's one of my favourite interviews questions and very few people get it right.

simonw2• 1 month ago

To understand CORS, you have to understand the Same Origin Policy.

If you find CORS difficult to understand, particularly the question of "why do we need this?", I suggest starting here: https://developer.mozilla.org/en-US/docs/Web/Security/Defens...

I've tried using the Same Origin Policy as an interview question in the past, but it's not a good question because the majority of candidates aren't familiar with it, so you learn very little by bringing it up.

embedding-shape6• 1 month ago

I've tried using the Same Origin Policy as an interview question in the past, but it's not a good question because the majority of candidates aren't familiar with it, so you learn very little by bringing it up.

For hiring frontend developers, I've found it to be an excellent question, as surely if you've been developing web apps, you essentially must have come across it at some point. If you haven't, I'd be asking more questions about how typically you'd communicate with a backend and so on. Some people have hit the issues related to CORS, worked around it the quickest possible way then forgot all about it, rather than understanding what's going on, also a useful signal for some roles.

Bit less good for backend roles, as not everyone has worked closely with a frontend team which tends to be the people hitting issues around CORS.

simonw2• 1 month ago

Frontend candidates who have worked with CORS still aren't able to explain SOP and why those policies exist, in my experience. CORS is seen an irritation to be worked around.

There are a few examples of that in this HN thread!

yearesadpeople• 1 month ago

The comments - helpfully - are great examples of the essence of what the article is attempting to communicate. Bravo!

revetkn• 1 month ago

I did not really understand CORS until I sat down and wrote a server implementation of it and had to think hard about "what hooks should be exposed to developers for controlling it?"

Most of us I think just "expose a set of whitelisted origins and be done with it".

Here is where I landed for how to specify your server's CORS policy:

https://soklet.com/docs/cors#custom-workflow

sivalus• 1 month ago

CORS could be handled by your SRE/DevOps/Security equivalents and they will probably do it better because they more often operate while seeing the entire landscape. Feature developers are typically trying to work in a particular area at a time and lose 'peripheral vision'. Or maybe it's something to be learned at the staff/late senior level where you can get more of that perspective because you should have more freedom. The situation in this article also means this was missed by their security folks as well.

Who decided this was a developer's responsibility?

Calgaryp• 1 month ago

I remember as a student that CORS problems drove me crazy. 6 years later, nothing changed

PunchyHamster3• 1 month ago

CORS is just patch over patch over patch on a terrible idea on how to provide theatre of security

default-kramer• 1 month ago

I understand how the Same Origin Policy protects browsers from executing malicious scripts. I also understand how the Access-Control-Allow-Origin header can be used by servers to declare additional origins as trustworthy, relaxing the SOP.

What I still don't understand is what purpose the Access-Control-Allow-Headers header serves. It doesn't seem like it improves security for the browser (and definitely not for the server). Was it included "just for completeness" by the protocol designers? See also https://stackoverflow.com/questions/17992042

xtracto• 1 month ago

Ha! I kind of understand (apparently not really well from reading comments) CORS and many other web dev related constructs but oftentimes choose to work around them like what the zoom people did on the article exactly for this reason:

https://news.ycombinator.com/item?id=48616086

The whole thread shows that It seems even highly technical people that supposedly know a lot about this shit get it wrong. Because the mechanics are so complex, nobody really knows how they really work. Or it is a freaking mess or chore to achieve something.

Similar to just making a website HTTPS... even with let's encrypt and certbot , why does making a site https have to be so hard? (Try it on a service within a vpn).

apitman• 1 month ago

Is the CORS API too complex and confusing

Yes

dang• 1 month ago

Discussed at the time:

Developers don't understand CORS - https://news.ycombinator.com/item?id=20404578 - July 2019 (355 comments)

almog• 1 month ago

I think part of what makes CORS hard to remember is the amount of conditional branches it contains, which partially stems from being modeled to have backward compatibility with HTML forms (which defines how CORS behaves for "simple requests). Remove this legacy trap and there are far fewer cases to remember.

Of course, that can't be undone now but I think the original-ish sin was when forms suddenly could perform _both_ cross origin requests _and_ get the ambient authority treatment (i.e. send the user cookies with the request though to be fair, basic auth + forms also enabled similar attacks even before cookies were introduced in the mid 90's).

themanmaran• 1 month ago

The fact that the top comment [1] sparks a thread debating how CORS does / doesn't work is a great argument in favor of the original title.

[1] https://news.ycombinator.com/item?id=48616086

temporallobe• 1 month ago

I read through the comments to make sure I wasn’t the only one…Nobody understands CORS because it’s too complicated and too conflicting. The standards and the headers are always changing too, so mostly what happens is that we developers just tinker with it until it works, then ship the product and call it a day. Even when it works, you may still end up with errors and warnings in the dev console, but as long as things appear to be working, we leave it alone.

naishoya• 1 month ago

It's security theatre all the way from top to bottom: extra effort for devs and users alike, no real comprehension of any of the threat models at any level of interaction from the original design - which makes it fit right in with the rest of the entire java and advertising me-cosystem.

It's truly confusing to see businesses with real PII, financial, and technical risks choose not to simply disable java for all websites on work systems' browsers; bake settings and other restrictions into immutable VM templates. From these run ephemoral/disposable, per-application suite VM's to enable the office workers to use the tools required for their jobs.

If a worker wants user-upload and FB utility they are free to use their own devices (phones) when they are on break.

If a role has specific need for a specific site that requires special refinements/relaxation or the security policies then that can have it's own templateVM and this allows granular control of which VM instances have access to which other instances' clipboard and if it is one-way or bi-directional.

These techniques aren't novel, aren't actually that difficult, and are actually in-use in many workplaces. Even on legacy systems this has been possible with Windows environments which require full Office utility - since the XP era with 'Embedded' tools like WindowsCE <~ not the best way to do it, but I have seen it done at scale by multinational enterprises.

Every reboot spawns a completely clean; custom configured clone of the 'official' image; and if too much changes - that clone evaporates and restarts from read-only image.

All the rest of this ''back-end, front-end, let some people in, keep others out, filter by structure but not by content,'' ... it's just such an exhausting topic to even read about, and i wonder what kind of kool-aid everyone drinks to get them to pretend any of that is actually for any purpose than to allow FAANG/MANGOS/SPAM tech-bro cults to suck up all the user activity meta+data from the free garbage they are peddling.

I need either more coffee, or less Uisge beatha bhon Hosh.

dedoussis• 1 month ago

I've always wondered if part of the root issue is that Same-Origin Policy, and CORS by extension, were not very intuitively designed abstractions/APIs to begin with.

Developers don't understand CORS (2019)

Related Stories