Developers don't understand CORS (2019) (fosterelli.co)

Article summary

The article discusses how many web developers do not understand how CORS (Cross-Origin Resource Sharing) works, citing the recent Zoom vulnerability as an example. The vulnerability was caused by Zoom's attempt to bypass CORS, which led to a security issue. The author argues that understanding CORS is crucial for secure web development. The article also highlights the importance of proper CORS implementation to prevent similar vulnerabilities.

Main themes

• CORS understanding
• Web security
• Developer education
• Zoom vulnerability
• Browser security features

What commenters say

• CORS is difficult to understand and debug, with intentionally opaque error messages that can lead to frustration and security issues.
• The CORS threat model is often misunderstood, and its purpose is to prevent unauthorized access to resources, not to block all requests.
• Some developers believe that CORS is not effective in preventing attacks, as it can be bypassed by scripts or programs that fake HTTP headers.
• Others argue that CORS is essential for protecting users from malicious scripts and preventing data exfiltration, but it is not a substitute for proper security measures such as CSRF tokens.
• There is a need for better developer education and awareness about CORS and web security, as many developers do not understand the underlying threat model and its implications.
• CORS is not a mechanism for protecting assets from hotlinking or leeching, but rather for protecting users from malicious scripts and preventing data exfiltration.
• The effectiveness of CORS in preventing attacks is debated, with some arguing that it is useless against determined attackers, while others see it as a necessary layer of defense.