Re: CORS and null

Banning the former makes sense to me.

It has the impact that sandboxed frames can't make XHR requests to CORS
enabled resources, which is potentially problematic in the cases where
you'd like to sandbox off a portion of your application that processes data.

The workaround would be for the parent frame to request the data, and to
pipe it into the sandbox via postMessage. That's probably better from a
security perspective anyway; if the sandbox doesn't need to make requests,
it shouldn't be allowed to.

-mike

--
Mike West <mkwst@google.com>
Google+: https://mkw.st/+, Twitter: @mikewest, Cell: +49 162 10 255 91

Google Germany GmbH, Dienerstrasse 12, 80331 München, Germany
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg
Geschäftsführer: Graham Law, Christine Elizabeth Flores
(Sorry; I'm legally required to add this exciting detail to emails. Bleh.)


On Mon, Jun 2, 2014 at 10:55 AM, Anne van Kesteren <annevk@annevk.nl> wrote:

> Allowing
>
>   Access-Control-Allow-Origin: null
>   Access-Control-Allow-Credentials: true
>
> is effectively equivalent to allowing
>
>   Access-Control-Allow-Origin: *
>   Access-Control-Allow-Credentials: true
>
> given sandboxing. Given that we do not allow the latter, should we
> start banning the former?
>
>
> --
> http://annevankesteren.nl/
>
>