A Hipster History of CORS
summary
Chronicle of why CORS looks weird: it implements simple requests (only HTML-era GET/POST shapes), enforces reading via Access-Control-Allow-Origin and credentials rules, and adds the costly preflight OPTIONS round trip and miscached limits that wreck REST/latency. Browser hardening (Sandboxes + Spectre) motivates runtime isolation features—COOP and COEP—and network headers like CORP/CORB to stop HTML leakage and let trusted pages get finer timers. Practical takeaway: CORS is compatibility plus server opt‑in, with real performance and process‑isolation tradeoffs.
AI-written summary · about
chapters (5)
- 0:00Start
- 17:43CORS: Preflight Requests
- 28:11Cross Origin Read Blocking
- 33:18Cross Origin Opener Policy
- 34:12Cross Origin Embedder Policy
related talks
13mCORS: Cross-domain requests with JavaScript
26mTalking to Browsers with CORS
41mHow About a Tour of CORS?
25mWe Still Don’t Have Secure Cross-Domain Requests: an Empirical Study of CORS
08mEnable and debug cross-origin isolated
40mMisconfigured CORS and why web appsec is not getting easier
15mNo, It's Not a CORS Error
18mCORS, XSS, CSRF, SQL injection #BackToTheBasics