I never really liked the direction CORS (cross-origin resource sharing) is taking. I think there's a misconception how client-server communication should work.
The general concept is:
User:
HelloServer
, I'm sending such request
- Server supports request:
Server:
Hello user, I'm sending my response to your request.- Server does not support request, REFERRER does not match etc:
Server:
400 - bad request
But, ok, let's say CORS is doing servers a favor by assuming 400
errors on certain attempts - such as getting user's profile information abusing the fact he's logged on. I think this is indeed good, but looks stupid the way it's now implemented:
Script wants to send request to different origin...
User:
HelloServer
, I want to send a request. What requests do you accept?
- Server is aware of CORS:
Server:
Hello user, I'm sending my CORS policies.
Browser decides to send or not to send...- Server is not aware of CORS:
Server:
404 - not found
Damn... I just wanted to fetch an image...
But why does CORS not just strip the cookies then? Often scripts want to fetch JSON, other scripts or images from different origin. In that case, they have to establish a server proxy. These proxies are quite popular.
This progress has quite complicated the server independence of web applications (which are now able to save files, parse files and so on).
So what's the point of blocking a GET request I can bypass over a proxy?