4 ms·
CORS is not the end all be all of security. You should have a reasonable CORS policy of course, but assume that you have malicious clients who disable it in the
by ch33zer 5y ago
CORS is not the end all be all of security. You should have a reasonable CORS policy of course, but assume that you have malicious clients who disable it in their browser to see what your backend does or, even simpler, they just use get.
- staticassertion 5y agoThe assumption here is that the attacker controls a domain A, and the victim is visiting A. The victim is also logged into a benign site, with domain B. A's CORS policy is irrelevant, the attacker can "disable cors" for A, but it will accomplish nothing, B has CORS enabled. The attacker could make an HTTP request to B and set 'no-cors' or whatever, but then it couldn't include credentials (if you're using HTTP cookies), and again, B would still just reject the request. So I'm not sure what you're saying is true. This isn't my area of security, happy to hear if I'm mistaken.
- edoceo 5y agoI think they just mean to not use CORS as the only method of validation
- TheCoelacanth 5y agoThe same-origin policy protects users of your site from being attacked. It doesn't do anything to protect you (except indirectly by protecting your users).
- herodoturtle 5y ago> CORS is not the end all be all of security. Hi friend, just a heads up, it's "the be-all and end-all" :-)