something I don't think I've ever seen explained is whether there's any situation where it's safe to set "Access-Control-Allow-Origin: *" other than "if your site literally never serves any private data"
(I often hear "don't do it" which is fair I guess, but also like the Mastodon API intentionally sets Access-Control-Allow-Origin: * and that's extremely useful)
also is there any name for the attack(s) that setting "Access-Control-Allow-Origin: *" might expose you to? i feel like it's so much easier to talk about security stuff in terms of the specific threats we're trying to avoid, but I can't think of the name for it
(edit: I think it's CSRF)
@[email protected] And there's another line by which every modern dev has to greet the hat of browsers bowing to people's inability to follow standards: <meta name="color-scheme" content="dark light"> Way before smartphones and dark mode, I was taught by @[email protected] to not assume default colors, and thus to only set foreground colors I also set background colors -- in case someone has unconventional defaults. (Along with using percentages vs absolute lengths to work, and not assuming any DPI value).
Julia Evans
chrysn