We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Hacker News·Jun 21·5 min read
Developers don't understand CORS (2019)
TL;DR
Many web developers struggle to understand Cross-Origin Resource Sharing (CORS), which governs how web applications interact with resources from different origins. A recent security issue with Zoom highlighted this gap, as it used a localhost web server to bypass CORS restrictions.
✦ Why It Matters
Understanding CORS is crucial for developers to prevent security vulnerabilities in web applications.
Key Takeaways
- Learn how CORS works to secure applications.
- Avoid using localhost to bypass CORS restrictions.
- Implement proper CORS headers in APIs.
- Stay updated on security vulnerabilities in web applications.
Full Summary
Cross-Origin Resource Sharing (CORS) is a security feature that restricts web applications from making requests to a different origin than the one that served the web page. A recent vulnerability in Zoom revealed that the application utilized a web server running on localhost to circumvent CORS policies.
Instead of a standard AJAX request, Zoom's website loaded an image whose dimensions encoded the server's response status. This method exploited the fact that browsers typically ignore CORS restrictions for localhost servers.
However, contrary to the article's claim, modern browsers like Chrome do respect CORS headers for localhost. This incident illustrates the need for developers to fully understand CORS to prevent security vulnerabilities.
By recognizing how CORS works, developers can better secure their applications against similar exploits.