Contrary to what the doc claims, CORS is no defence
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 717
- Forks
- 1.2k
- Avg merge
- 3d 15h
- Merged PRs (30d)
- 19
Description
The file content/docs/operating/security.md contains the following passage:
For non-mutating endpoints, you may wish to set CORS headers such as
Access-Control-Allow-Originin your reverse proxy to prevent XSS.
However, this passage is problematic, because CORS is no defence against XSS. In fact, CORS is no defence at all; quite the opposite, since its goal is to relax the Same-Origin Policy.
This passage should be reworded or even removed.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Open content/docs/operating/security.md and review the passage linked around line 179, along with the linked CORS specification and reference. Reword or remove the claim that CORS prevents XSS, leaving the security guidance accurate and consistent with the issue's concern.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 65/100