#cors — Public Fediverse posts

So is the whole deal with CORS headers just "pretty please don't make requests" and the server trusts the client browser to not? I gotta be missing something cause that sounds dumb as hell

#CORS #WebDev

SOP & CORS

Держите открытыми две вкладки. В одной — интернет-банк, куда вы залогинены и где на экране висит ваш баланс. В другой — какой-то сайт, на который вы забрели по ссылке из выдачи, ничего особенного. Теперь вопрос, который на первый взгляд кажется надуманным, а на деле упирается в фундамент всей веб-безопасности: что мешает скрипту со второго сайта взять и прочитать ваш баланс из первого?

https://habr.com/ru/articles/1069658/

#cors #sop #sameorigin_policy #crossorigin #веббезопасность #xss #csrf #браузеры #httpзаголовки

Ach du 💩 . Nachdem ich bei Hetzner grad nicht fündig werde (irgendwas Webserver mit #WebDAV, #Authn, #CORS policy konfigurierbar) hab ich bei ionos vorbeigeschaut.

1. Man kann initial die Preise nicht erkennen, weil lauter durchgestrichene Preise und andere Preise daneben und irgendwas mit 3 Monate.
2. Angeklickt um zu sehen, ob man den Preis findet. Nö, erst ein Popup was mit allen Drecksmitteln der Hütchenspieler versucht, einen zum nächstteuren Paket zu verleiten.

Geht kacken, #IONOS.

1/ An independent analysis of UPLB's enlistment system (my final contribution as a graduate):

https://fofajardo.is-a.dev/blog/2026/07/the-road-to-patience-why-amis-is-still-slow-three-years-later

#amis #uplb #cors #web #webdev #browser #performance #api #universities #up #philippines

Need CORS for your S3 bucket that allows all origins except one malicious domain? Standard S3 CORS doesn't support wildcard exclusions, but you can combine AllowedOrigins with a bucket policy Condition element to deny specific origins. Here's the workaround. #cors #snippet #aws-s3 #bucket-policy #ValtersIT

https://www.valtersit.com/vault/cors-with-wildcard-exclusions-for-cdn-origins-in-aws-s3-455edc/

Boost your static asset delivery: Configure Apache to cache CORS preflight responses for 24 hours via Access-Control-Max-Age in .htaccess. This eliminates redundant OPTIONS requests for fonts, images, and scripts from CDNs. #cors #apache #preflight-caching

https://www.valtersit.com/vault/cors-preflight-caching-with-maxage-for-static-assets-e149eb/

Apparently, #developers are too busy pretending to code in fancy cafes to even Google "CORS" 🤦‍♂️. But don't worry, Chris Foster is here to save the day by stating the obvious: understanding basic web security is like, really important, guys! 🙄🔍
https://fosterelli.co/developers-dont-understand-cors #websecurity #CORS #codinghustle #ChrisFoster #techhumor #HackerNews #ngated

Developers don't understand CORS (2019)

https://fosterelli.co/developers-dont-understand-cors

#HackerNews #CORS #Developers #WebSecurity #Programming #2019

A friend gave me a 3.5" touch-screen for a Pi.
So, now I have to build a mini dashboard that runs of a Pi3, to display some Home Assistant charts. Because #HomeAssistant itself on a Pi3 is torture, both for me and the #Pi.
But, in trying that, of course I run into stupid #CORS issues

Зачем нужен язык ArchiMate

На одной из ИТ конференций по бизнес-анализу я проводил мастер-класс «Моделируем IT архитектуру предприятия». Участники были разбиты на группы, и было дано одно из заданий из нашего Курса аналитика 1С:

https://habr.com/ru/articles/1043356/

#archimate #cors #itархитектура

4 Tiny Mistakes That Secretly Destroy App Performance, by (not on Mastodon or Bluesky):

https://dev.to/sylwia-lask/4-tiny-mistakes-that-secretly-destroy-app-performance-3cgo?ref=frontenddogma.com

#performance #webapps #mistakes #cors #codesplitting #dependencies #backgrounds #images

I just renewed my vehicle registration/insurance. We have a provincial crown corporation here that has a monopoly on it.

I ran into a problem with their "new & improved!" website [1]. I always do. This one is boring; like 90% of the issues I run into, it's because the developers have only tested the site with Chrome, and they're violating CORS policy (a security thing) so Firefox prevents a request trying to fetch part of the page contents. Chrome doesn't give a damn, it doesn't want to stop any trackers or anything.

But the 🧑‍🍳 😘 in the whole thing is ... there are various "Feedback" links and buttons. I want to report the issue, so I try them, and ... they haven't actually provided the HREF attribute on the links/buttons at all. They are literally not hooked up to anything.

Good testing on the new site, boys! You sure you didn't miss testing any of the functionality?

[1] Why companies absolutely insist on regularly improving their websites into unusability escapes me. As I mentioned elsewhere, it's not like the HTML of the working site has a best-before date on it.

#CADT #WebDeveloper #Firefox #CORS #HREF #feedback #NewAndImproved #qwality #WeveHeardOfIt

One Open-source Project Daily

CORS Anywhere is a NodeJS reverse proxy which adds CORS headers to the proxied request.

https://github.com/Rob--W/cors-anywhere

#1ospd #opensource #cors #nodejs

[DEV_LOG] PHASE 1.7.5.b: CORE_LOGIC_ERROR

​Mid-week update: It’s worse than it looks. A cascade of ReferenceErrors and TypeErrors is hitting the original build.

​Diagnosis: Identified a failed "Lazy Import" implementation. The browser is triggering a terminal CORS failure on load. Manifest loading is blocked. PWA/Offline capabilities are dark.

​We are sitting with the wreckage for now.

#WebDev #CORS #SystemFragmentation

I think I just managed to make my Object Storage (#s3 compatible) work on my #peertube

First, it took 2 weeks because I got a bug with #ovhcloud where they wouldn't deliver the product.

When I got it set up, it was quite straight forward. Just copy/paste all the infos and keys into the peertube config file.

My only struggle was realizing that I had to apply some #cors settings to my bucket.

Other than that, #yunohost makes selfhosting quite easy.

The next step will be to migrate my videos to the instance.

https://social.fraxoweb.com/@frank/statuses/01KG8DX3X7815RFAS3A4ZMV54C

Ooooh, fcuk, it is even worse. I do a JavaScript fetch request. Internally it notices that it needs to do its CORS OPTIONS magic first. That one fails with a 404, as the developer tools show. But the fetch request itself fails. No, it does not come back with a 404 response. It just fails the fetch with

TypeError: Failed to fetch

This even though the OPTIONS response says

Access-Control-Allow-Origin *

beside the 404. This is baaaad!

#cors #http #fetch

Fun with #CORS.

Many web devs come across CORS eventually, first reaction being WTF. Then see Stackoverflow or a chatty text randomizer to find.

The server response lacks the Access-Control-Allow-Origin header

which is confusing, as you're dealing with two servers at this point.

I thought to understand it, but debugged an hour to find that an OPTIONS request for .../blabla does not follow the redirect to .../blabla/ (in Firefox at least) .😠

https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS/Errors/CORSMissingAllowOrigin?utm_source=devtools&utm_medium=firefox-cors-errors&utm_campaign=default

#firefox #webdev

For schedules that block cross-origin access in the browser (e.g. #FOSDEM), there's now a small companion project: the Skedz CORS Proxy. A simple proxy with a domain whitelist, easy to self-host or run locally.

Public instance: https://cors.skedz.org
Example: https://cors.skedz.org/https://fosdem.org/2026/schedule/xml
Source (AGPLv3): https://github.com/ysorge/skedz-cors-proxy

#cors #proxy #fahrplan #skedz

Question for nerds and video watchers: are the closed captions available in this (you may have to enable them)?

https://m.earth.org.uk/smart-radiator-valves-talk-20201112.html

#CORS #VTT #ClosedCaptions

Wenn #Google mal seine #CORS-Header in den Griff bekommen würde, that'd be great. Seit über einer Woche versuche ich, die Öffnungszeiten der Praxis der Frau in den Suchergebnissen zu aktualisieren.

Aber KI in die Results, DAS geht 🙄

Bekackte Amateure.

Un article un peu ancien(2021) mais qui explique le principe du CORS qui rend fou de nombreux développeurs.

C'est un concept que je conseille à tous les dev web de maîtriser sur le bout des doigts histoire d'éviter de futures prises de tête.

🔗 https://jakearchibald.com/2021/cors/

#CORS #web

Quick question for the #web #security people here:
If a local device in your network has an API endpoint that may leak your location but has no CORS headers set, who would be able to get that data?
My understanding is that it is not possible to get that data from another webpage (at least when a somewhat modern browser is used) but if say somebody queried that from an app you installed on your phone they could read it?
#CORS