Developers don't understand CORS (fosterelli.co)

Article summary

The article discusses how many web developers do not understand how Cross-Origin Resource Sharing (CORS) works, citing a recent vulnerability in Zoom as an example. CORS is a security feature that prevents web pages from making requests to a different origin than the one the web page was loaded from. The article argues that Zoom's implementation of CORS was insecure and that a better approach would be to use a REST API with a specific Access-Control-Allow-Origin header. This would ensure that only authorized domains can make requests to the API.

Main themes

• CORS
• Web Security
• Same-Origin Policy
• API Design
• Authentication

What commenters say

• CORS is often misunderstood by developers, leading to security vulnerabilities.
• The CORS specification is flawed and can be confusing to implement.
• Dynamic Access-Control-Allow-Origin headers can be used to securely allow multiple domains to access an API.
• Using Access-Control-Allow-Origin: * can be a security risk if not implemented carefully.
• CORS is not a replacement for proper authentication and authorization mechanisms.
• The same-origin policy can be bypassed by malicious scripts, highlighting the need for careful API design.
• Newer browsers have improved CORS support, but older browsers may still be vulnerable to certain attacks.
• Marking cookies as same-site can help mitigate some CORS-related security risks.