HN

Comments (92)

• Menu

  muvlon
  Even TFA seemingly doesn't understand CORS. Or at least misreprents it grossly:> The webserver listening in on localhost:19421 should implement a REST API and set a Access-Control-Allow-Origin header with the value https://zoom.us. This will ensure that only Javascript running on the zoom.us domain can talk to the localhost webserver.No, that does not do that. JavaScript from any other website can still talk to localhost:19421 just the same. CORS doesn't restrict anything, it loosens the default set of restrictions (ignoring preflight requests for now and assuming we're talking just about "safe" Methods). That Access-Control-Allow-Origin header just allows JavaScript running on zoom.us to read the responses when it queries localhost:19421. The requests happen in any case, and you must ensure in your backend that they don't cause any adverse effects.
• Menu

  kittywantsbacon
  I think this is legitimately the least informed HN comment section I've ever seen. Entirely proving the author's point.
• Menu

  himata4113
  It was pretty amusing reading the comment section so I'll chime in: SOP protects you (the browser) from leaking information to websites that should not be able to access that information and CORS allows you to weaken it.Example: SOP stops example.com from fetching the list of subscriptions on youtube.com. But CORS allows example.com to access youtube.com/public/*.This is also not the sole use-case, it also stops your backend api being up under a different frontend which would allow data theft since you could log into real services on google.com, but you're actually on g00gle.com enabling data exfiltration because now every request can be MitM'd.
• Menu

  encomiast
  It's not just CORS that's hard to understand. Many (most?) developers don't really understand the threat model. And even when it's explained it hard to see why it's a big deal. Part of this is that backend developers usually have to configure CORS and it's not an access privilege protection. From the point of view of the backend it doesn't seem to matter. Bad guys can't get it. From the point of view of the front-end it's often seen as a nuisance.The article does a nice job giving a concrete example.
• supriyo-biswas
  I wish more people read the CORS article on MDN[1] which helped me a lot at the time when I was trying to understand it. I knew some people had trouble with CORS but had no idea it was this bad, going by the comments here.[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/COR...
• StrauXX
  This blog post is very misleading.> So what would a secure implementation of this feature look like? The webserver listening in on localhost:19421 should implement a REST API and set a Access-Control-Allow-Origin header with the value https://zoom.us. This will ensure that only Javascript running on the zoom.us domain can talk to the localhost webserver.First of all, its not CORS that protects. CORS is an anti-security feature. What does protect is the SOP (same origin policy). The SOP (or SOPs rather, it's not really one feature but more of a paradigm in the standards) blocks documents from one origin, from reading data that belongs to another origin. This is the reason why `let w = window.open("https://example.com"); console.dir(w.document.body);` will work when it is ran from example.com, but not wikipedia.org. Only when protocol, host and port match, can documents access each others data (there is an interesting differential with cookies here, their SOP only looks at protocol and host, not port).Importantly, the SOP only blocks reading data from other origins, not writing! So while example.com won't be able to read the response of a post request it sends to wikipedia.org, the request is sent and processed nontheless!CORS now is a feature that allows sites to loosen up the SOP. This allows documents to read cross origin data nontheless. Namely, HTTP responses. (Standards for reading other kinds of data cross origin exist, but are not related to CORS).
• Izmaki
  I don't fully understand CORS and was hoping he'd explain how it works. :(
• Menu

  piyh
  The only thing I remember about CORS is that it takes way longer than expected to debug, by design the error messages sent to the browser are intentionally gutted, and CORS error scenarios are hard to tell from other failure modes atfirst glance.
• Menu

  mparnisari
  I'm one of them. CORS is THE topic that I have to get a refresher for periodically. It's like I forget about it, it never sticks. I'm a backend developer so I never encounter any cors issues. Maybe that's why? I seem to forget things that I don't use on a day to day basis, so.
• jdw64
  Sometimes I'm not even sure what I truly 'understand.' When even senior engineers working on products used by hundreds of millions of people, like Zoom, have had these kinds of issues, it makes me wonder. So I usually just write code the way it was left by my seniors, out of inertia. But I realize that the area I work in is actually incredibly abstracted.
• Menu

  frogulis
  From my experience, the reason CORS is hard to understand is that it's somehow inverted from the default "shape" of security in web dev.We easily form the intuition of the client being a by-default untrusted entity, and checking whether it has the privilege of accessing this data, where the server is the arbiter of that access.CORS is so inherently different to that, and while the information is easily available, it requires a short but careful read to grok the idea -- which a dev tunnel-visioning towards getting their application code written may not wish to slow down for.
• kartoshechka
  - cors docs are written either from solution or implementation point of view, not the "why this exists, and how we successively deal with bad actors trying to game cors", cors RFC is terse- protocol itself is quite nuanced, like iirc requests with Authorization (or some other) headers don't obide by usual rules, and again for developer it's just an arbitrary convoluted set of rules, if they don't grasp the problematics- backend and frontend should work in unison to have correctly configured cors, but as we know, devs hate communicating with each other
• drchaim
  I understand CORS each time I need to fix or to avoid them ;)
• Menu

  physix
  > Developer's don't understand CORSCount me in!
• thomask1995
  I think some sort of gui to help write the cors headers would help tbh.it's quite difficult to get your stack to work for local dev, CI, and prod since each most likely needs different cors headers. Especially if you use tunnels and proxies like we do.What made it click for me though was understanding what problem it solved.
• preommr
  Because, like many things in web, it's a patchwork of compromises due to legacy issues, rampant inconcistencies and trying to be too clever.You get results where it's really difficult intuitively understand it because at that point you're not really meant to. Realistically, people just follow a guide, or some lib, and move on.
• ozim
  Issue is that for most projects CORS is set and forget. You don’t run into it once a month or even once a year - you run into it when setting up new project from scratch.Many or most developers work on existing projects that have all kinds of security defaults set somewhere in the past and no one bothers reviewing those.
• Menu

  robertclaus
  I bet there's an awful lot of servers out there that will happily take CORS requests from any host because someone didn't understand why their second domain couldn't talk to the same API.
• Menu

  stephbook
  I still don't understand the threat model and, obviously, it's not explained here either.I log in to social.net. I click on scam.org and change sites. I'm on scam.org and it triggers a request to social.net/friends.No cookies are sent, no JWT. I'm not logged in and get a "Needs login" HTTP error. Nothing bad happens.I thought that's how it works without CORS already.
• piterrro
  Wait, isnt it implemented because of the sheer number of broswers that could be used at the Zoom’s scale? They could’ve used jsonp too it they wanted to bypass CORS. Using image with different dimensions sounds like the most bulletproof way across multiple devices/OSes/browsers
• Menu

  ottoflux
  the amount of code i've seen either allowing * when it shouldn't because someone was desperately trying to make their code work is astounding.contractors, "specialists", etc. who never took the time to read how CORS works and how simply you can handle a list of allowable sites, etc.it's only complicated until you take the 5-10 minutes to properly understand what happens where. if you don't know, go do it now.
• deathanatos
  Generally when I'm debugging these, I need/want to know what was the preflight (if applicable), and was the preflight what was expected? When I help others debug these, generally I find there is little expectation of what the preflight "should" be, and instead just a bunch of stochastic attempts to adjust the server's response headers to get the browser to capitulate — regardless of whether that makes any sense at all.I would also say I think Firefox's network inspector is better in this area. (But I'm often having to ask others to "no, don't send the failing request, send the CORS preflight", we need to understand what happened with it.)> Anecdotally, lots of developers I’ve talked with don’t understand well how CORS works.Yeah, most FE devs I've worked with seem to not understand CORS.> Is the CORS API too complex and confusingI think it can be hard if you don't understand why the exceptions to preflights are what they are, but the moment you internalize "because the browser can already emit that request in other cases" then it becomes obvious what categories are what & why.
• foundart
  Correct. Where are some good explanations?
• Menu

  rusk
  It’s TOS for using ebdpoint. It says:access is provided under condition you respect these restrictionsYou are not obliged to honour this. It is not enforceable so it seems strange.Browsers enforce it, but it can be turned off and nobody expects it to be implemented by a simple REST client application.It’s a gentleman’s agreement. It’s a statement of expectation to the browser. On the one hand it may be for the protection of the browser user, from cross site attacks, and from malicious code on the web.But crucially it provides little protection for the endpoints themselves bar accidental misuse.It is very unusual and rare example of “cooperative” security in a web that’s frequently so adversarial.And that’s what makes it hard to grasp.
• Menu

  d--b
  A CORS protected endpoint tells YOUR BROWSER not to let YOU access its content if the website you’re browsing from is not whitelisted.It’s confusing because unlike most security features, it’s meant to protect the users from themselves. The risk comes from a combination of users being allowed to visit malevolent sites and browsers letting all websites do a lot of random stuff, including making 3rd party requests with cookies and private stuff
• Menu

  ralusek
  I understand CORS and I don't.TL;DR: It's a restriction your browser gives itself. If it's on Domain A and it sees a request going out to Domain B, unless Domain B responds saying that it's expecting traffic from Domain A, the browser prevents itself from making the call.I think the part about it that is off/silly to most people is that it's not a normal security threat model, because a malicious client could simply just...not impose that restriction on itself. You're perfectly capable of going and curling that same request to that backend, or calling it from an app, or any number of other things. So it's not really protecting your protected resource, the backend, from malicious clients.All of that is where I feel like I understand clearly. The part I fail to retain is the exact scenarios it does protect against, which IIRC, are basically about attempting to protect your users from being misguided on other clients that are acting as your client, something like that (but again, this literally only applies to browsers). It's just kind of a weird niche problem that I often find myself thinking "I mean why is the user on another client and have allowed themselves to authenticate on that client with my server...this sounds like the user's fault."
• Menu

  dboreham
  The only thing to understand is that it does nothing useful today.
• formit34
  [dead]
• Tanxsinxlnx
  [dead]
• vladsiu
  [dead]
• rfmoz
  [dead]
• utopiah
  I definitely understand CORS in theory, then when it's time to solve a CORS related error, anything goes. /s
• OffBeatDev
  [flagged]
• Menu

  mock-possum
  I honestly just can’t be arsed. I write the code to do the thing I want, and if CORS throws a wrench into things, I make Claude fix it for me. I’m tired boss.
• iririririr
  everything browser is about still allowing The Bad Thing Ad Companies need.cors et al is a freaking mess because those things are designed by a comitee choke full of people who last promotion was their cool idea about how to monetize referrer, or how do cookie match across domains, or profile you with millisecond it takes to list your usb audio devices, or etc etc etc
• Menu

  somat
  It's me, CORS was the stupidest thing I encountered in a long line of stupid when trying to put together a simple web app for the first time."So let me get this straight. We tell the client whether the application we gave them can or cannot make requests to our servers. And none of this actually prevents the client from making the requests if they want to?... Pull the other one it has bells on."It took a good sleep and a long shower to under stand it. "Oh... it is for if I want to do a self injection attack and allow random untrusted malicious code in my application. In other words, ads"Basically the threat model is inverted from any other threat model, that is why it looks so stupid. CORS is threat model used for when you can't trust your self.
• Menu

  koolala
  CORS sucks since Cross-Origin-Embedder-Policy: credentialless was never made standard across all browsers. It's a browser client restriction you can't turn off. If you want to do anything interesting with WWW content you have to run your own browser or run an out-of-box one off a proxy server that breaks everything.
• Menu

  rishabhpoddar
  I agree that CORS is hard to understand and fix. I was the CTO at an auth company and SO many of our users used to run into various CORS issues and asked questions on our support. However, I'd now argue that developers don't need to understand CORS anymore.. cause claude / gpt does! Just throw in the error in claude code / codex and it would fix it.