12
Developers don't understand CORS (2019) (fosterelli.co)
submitted 4 months ago by [B] to c/hackernews@lemmy.bestiver.se
3 comments fedilink hide all child comments
 

Comments

top 2 comments

sorted by: hot top controversial new old
[–] 3 points 4 months ago (1 child)

Interesting! He points to an article on how to implement a "very insecure" CORS policy, but not explain how to do it properly:

https://enable-cors.org/server_expressjs.html

So, how would a secure CORS in implementation look like?

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] 1 point 4 months ago

    Those examples are perfectly secure if you set the allowed origins to only your domains, or domains you specifically want to allow use of your API.

    If someone copied those examples verbatim, they'd end up allowing a website hosted at example.com to call their API. Which I suppose is technically not secure, but I wouldn't call it very insecure unless example.com was taken over by a malicious user.

  • permalink
  • fedilink
  • source
  • parent