this post was submitted on 10 Jul 2023
759 points (98.8% liked)
Lemmy.World Announcements
29079 readers
187 users here now
This Community is intended for posts about the Lemmy.world server by the admins.
Follow us for server news π
Outages π₯
https://status.lemmy.world/
For support with issues at Lemmy.world, go to the Lemmy.world Support community.
Support e-mail
Any support requests are best sent to [email protected] e-mail.
Report contact
- DM https://lemmy.world/u/lwreport
- Email [email protected] (PGP Supported)
Donations π
If you would like to make a donation to support the cost of running this platform, please do so at the following donation URLs.
If you can, please use / switch to Ko-Fi, it has the lowest fees for us
Join the team
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
This is about cors headers on the api calls? That only don't affect other apps because they are offline and ignore cors?
Native apps donβt have CORS restrictions. They can make http requests anywhere.
Only web apps in a browser have this limitation.
Makes sense, never thought about that. An annoying situation, I wonder how many security issues would crop up if browsers allowed ignoring cors for pwas...
Currently apicalls are proxied through the server but end up with the lient all the same, with the session being stored in local storage "credentials"?
Will you currate a manual whitelist for direct calls or have the app test if direct fails and fall back to proxied?
At this point it's manual. We could do some intelligent detection, but at the pace Lemmy dev is moving, I don't think it's worth it. The goal is to rip out the proxy completely once there's a bit more time for most servers to upgrade, and also https://github.com/LemmyNet/lemmy/issues/3567 is resolved.
Why not add a new tier to pwas. You need to only use cookies scoped to your own domain, you get a new container without any existing session cookies etc. for other websites, but cors is dropped.
That should prevent carelessly putting auth tokens into cookies and should replace cors in that sensitive sessions are containered away and all existing data for other websites that where slopily created somehow are isolated.
After all for the way wefwef works for example I see no benefit to cors