(fix): readme updated for #271 origin option for * #289
Conversation
README.md
Outdated
| - `String` - set `origin` to a specific origin. For example if you set it to `"http://example.com"` only requests from "http://example.com" will be allowed. | ||
| - `String` - set `origin` to a specific origin. For example, if you set it to | ||
| - `"http://example.com"` only requests from "http://example.com" will be allowed. | ||
| - `"*"` for all domains to be allowed. This is UNSAFE and not recommended. |
There was a problem hiding this comment.
This is UNSAFE and not recommended.
Can you elaborate on this, please? If it is unsafe and not recommended, then why would we leave this as a feature at all? I'm interested in learning more if you can point to some resources that explain where this statement comes from.
There was a problem hiding this comment.
Hi - Based on these couple of documentation online -
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
https://stackoverflow.com/questions/12001269/what-security-risks-exist-when-setting-access-control-allow-origin-to-accept-all#:~:text=on%20this%20post.-,Access%2DControl%2DAllow%2DOrigin%3A%20*%20is%20totally%20safe,auth%2C%20and%20TLS%20client%20certificates
PLs advise.
There was a problem hiding this comment.
I don't see anything about it being unsafe in your first link and the second link says both it is fine and not fine and doesn't seem conclusive, as it would depend on a lot of factors. The answer also looks like it is CORS in general and nothing specific to this module. The docs of this module should only be about using this module -- not all the details and information about CORS itself, as there are much better sources. A statement like "This is UNSAFE and not recommended." doesn't make any sense, as if it is that way, it shouldn't even be in the module's API.
There was a problem hiding this comment.
sounds good. Let me fix it.
Updated readme for - #271
Added String- set origin to '*" for all domains to be allowed. This is UNSAFE and not recommended.