"A Hipster History of CORS" by Devdatta Akhawe (Strange Loop 2022)

CORS makes no sense when you first look at it. The only way it does is if you understand the history of how we got here; this talk will go through the history of the web and CORS and how we ended up designing something like this. If you have always been confused by CORS, you will find this talk useful. We will also cover modern cross origin standards (corp, corp, corb, coop, coep, oh my) and how they can help securely design modern web applications.
Devdatta Akhawe
Director of Security, Figma
@frgx
Dev works at Figma, as part of the Figma Security team. Before that he spent nearly 6 years at Dropbox in various roles in the Dropbox Security team. He joined Dropbox after his PhD in Computer Science at UC Berkeley, where his research focused on web and browser security. He is also an editor on the Sub Resource Integrity specification. Other details, including how to really pronounce his name are at devd.me
------- Sponsored by: -------
Stream is the # 1 Chat API for custom messaging apps. Activate your free 30-day trial to explore Stream Chat. gstrm.io/tsl

[@recklessroges]

Best CORS explanation I've ever seen.

[@velociraptor5962]

This makes so much sense. I still hate CORS though - especially when trying to get data from APIs in web apps. haha

[@csours]

Developers who learn about CORS: "I don't want to learn about CORS, I want my thing to work!"
When you learn that CORS exists, it makes no sense. I read about 10 StackOverflow posts about it and 3 articles, and I still didn't understand it. I think it was the 3rd time that I had to deal with it I finally understood that it really doesn't fit my mental model of web security.

[@kesavamallela]

Some of the jokes were funny :) also, Go Pilani!

[@willmcpherson2]

The web is bandaids 😂

[@Verrisin]

So, can the hacked process access cookies of another origin? I would guess not, so whatever it does doesn't seem too bad ... both CORB and CORP sound useless? What is special about browsers? Cannot the attacker just do that irrespective of a browser?
- The point of a browser exploit is, you got inside the local network where I can make requests to servers that think they are behind a wall...
- All "secret images" should require Authorization + Authentication anyway, so it's irrelevant some process can make requests, if it doesn't have any secret tokens.
- What am I not getting?

[@Verrisin]

Wait ... it can open an anyway, and all of this is EVEN MORE POINTLESS??? What?