CORS headers security implications should be more specific
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 42/100
- Issue type
- Documentation
- Clarity
- Mostly clear
- Activity status
- Stale
- Domain
- documentation, security
Research direction
Start with the linked CORS troubleshooting page, especially the section on enabling CORS in a server you control. Review the explanation of Access-Control-Allow-Origin for localhost, sensitive content, sessions, cookies, and CSRF. Done means the page gives specific, transparent guidance about the security implications and when to use the native HTTP plugin.
Written by the indexing model from the issue text.
Description
URL
https://ionicframework.com/docs/troubleshooting/cors#a-enabling-cors-in-a-server-you-control
What is missing or inaccurate about the content on this page?
The docs state, "Allowing any origin with Access-Control-Allow-Origin: * is guaranteed to work in all scenarios but may have security implications — like some CSRF attacks — depending on how the server controls access to resources and use sessions and cookies.".
And that is the only word on the security implications of setting CORS headers. I think the docs need to be more specific and take a stance on whether adding the Access-Control-Allow-Origin header set to http://localhost (or whatever the protocol and hostname is), is safe/unsafe.
This is my interpretation.... If the content the server is serving is not sensitive then it is safe to add the headers. Otherwise, I would not want to add the headers and the native http plugin should be used. This is because a malicious site could be running at localhost in the browser, opening up CSRF attacks.
I think being more specific and transparent here is the best approach and will improve security.
- Dominant language
- MDX
- Stars
- 621
- Forks
- 3.2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 86
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from ionic-team/ionic-docs
-
content
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
ionic-team/ionic-docs#4705 ·
-
content package: angular
Difficulty 2/5 Half a day Newbie friendliness 78/100
ionic-team/ionic-docs#4702 ·
-
triage
Difficulty 1/5 Under an hour Newbie friendliness 80/100
ionic-team/ionic-docs#4546 ·
-
content: broken link Opencontent
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
ionic-team/ionic-docs#4381 · 2 comments ·
-
triage
Difficulty 1/5 Under an hour Newbie friendliness 72/100
ionic-team/ionic-docs#3639 ·
All issues in ionic-team/ionic-docs
Similar issues
-
Add: hunch Open
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
AbdelStark/awesome-typesafe#104 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
A11y ♿️
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Link Checker Report Openautomated issue report
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
documentation improve or update documentation priority/low triage
Difficulty 2/5 Half a day Newbie friendliness 86/100
warpdotdev/docs#782 · 1 comment ·