You must log in or # to comment.
Interesting! He points to an article on how to implement a “very insecure” CORS policy, but not explain how to do it properly:
https://enable-cors.org/server_expressjs.html
So, how would a secure CORS in implementation look like?
Those examples are perfectly secure if you set the allowed origins to only your domains, or domains you specifically want to allow use of your API.
If someone copied those examples verbatim, they’d end up allowing a website hosted at example.com to call their API. Which I suppose is technically not secure, but I wouldn’t call it very insecure unless example.com was taken over by a malicious user.
deleted by creator