Hacker News new | past | comments | ask | show | jobs | submit login

This works because the browser will run any third-party script, but it won't expose the raw string constituting the script.

So a malicious website can't steal that content by putting the URL in a script. It will never get to see what's in the script and only a same-domain script could parse the whole contents, by making a XHR call, and strip out the "while 1;" part. In contrast, a regular JSONP string is specifically designed for the third party to read it (by including code to call a callback function).

A lot of people still don't realise you shouldn't be serving private data as JSONP. Thankfully, CORS lets modern browsers go cross-browser safely, even with private data if things are configured right.




> Thankfully, CORS lets modern browsers go cross-browser

> safely, even with private data if things are configured right.

CORS does nothing to prevent CSRF attacks, see[1]. We still need to protect against CSRF.

[1]http://www.w3.org/TR/cors/#security


"Thankfully, CORS lets modern browsers go cross-browser safely, even with private data if things are configured right."

Would you clarify or add some pointers to where we can learn about CORS benefits for private data? CSRF is a huge but often underestimated issue.


Actually as yoghur points out, CORS doesn't protect against CSRF. A token must be passed for any privileged calls.

That said, a benefit of CORS is the ability to do non-GET methods. So it's safer in the sense of HTTP idempotence, ie you can change server state safely, using POSTs, DELETEs, and so on. You'd still need to pass a token, however.

(Of course I meant cross-domain, not cross-browser :).


There is not CORS benefits for private data if your CORS endpoint have a cookie based authentication.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: