Re: Why the restriction on unauthenticated GET in CORS?

On Fri, Jul 20, 2012 at 4:37 AM, Cameron Jones <> wrote:
> On Fri, Jul 20, 2012 at 8:29 AM, Adam Barth <> wrote:
>> On Thu, Jul 19, 2012 at 7:50 AM, Cameron Jones <> wrote:
>>> On Thu, Jul 19, 2012 at 3:19 PM, Anne van Kesteren <> wrote:
>>>> On Thu, Jul 19, 2012 at 4:10 PM, Cameron Jones <> wrote:
>>>>> Isn't this mitigated by the Origin header?
>>>> No.
>>> Could you expand on this response, please?
>>> My understanding is that requests generate from XHR will have Origin
>>> applied. This can be used to reject requests from 3rd party websites
>>> within browsers. Therefore, intranets have the potential to restrict
>>> access from internal user browsing habits.
>> They have the potential, but existing networks don't do that.  We need
>> to protect legacy systems that don't understand the Origin header.
> Yes, i understand that. When new features are introduced someone's
> security policy is impacted, in this case (and by policy always the
> case) it is those who provide public services who's security policy is
> broken.
> It just depends on who's perspective you look at it from.
> The costs of private security *is* being paid by the public, although
> it seems the public has to pay a high price for everything nowadays.

I'm not sure I understand the point you're making, but it's doesn't
really matter.  We're not going to introduce vulnerabilities into
legacy systems.

>>>>> Also, what about the point that this is unethically pushing the costs
>>>>> of securing private resources onto public access providers?
>>>> It is far more unethical to expose a user's private data.
>>> Yes, but if no user private data is being exposed then there is cost
>>> being paid for no benefit.
>> I think it's difficult to discuss ethics without agreeing on an
>> ethical theory.  Let's stick to technical, rather than ethical,
>> discussions.
> Yes, but as custodians of a public space there is an ethical duty and
> responsibility to represent the interests of all users of that space.
> This is why the concerns deserve attention even if they may have been
> visited before.

I'm sorry, but I'm unable to respond to any ethical arguments.  I can
only respond to technical arguments.

> Given the level of impact affects the entire corpus of global public
> data, it is valuable to do a impact and risk assessment to garner
> whether the costs are significantly outweighed by either party.
> With some further consideration, i can't see any other way to protect
> IP authentication against targeted attacks through to their systems
> without the mandatory upgrade of these systems to IP + Origin
> Authentication.
> So, this is a non-starter. Thanks for all the fish.

That's why we have the current design.


Received on Friday, 20 July 2012 15:51:47 UTC