5
CORS error while making request to lemmy API
(programming.dev)
Welcome to the web development community! This is a place to post, discuss, get help about, etc. anything related to web development
Web development is the process of creating websites or web applications
Some webdev blogs
Not sure what to post in here? Want some web development related things to read?
Heres a couple blogs that have web development related content
Well I'm not expert on CORS, nor with the Lemmy API, so it's probably better to read about CORS exploits in more detailed articles.. https://www.freecodecamp.org/news/exploiting-cors-guide-to-pentesting/ for example
It seems Lemmy is storing a JWT in the cookiejar, so with
Access-Control-Allow-Credentials:trueand the domain inAccess-Control-Allow-Origina site should be able to do authenticated get requests on a users behave with the JWT, and access personal data.The "GET https://programming.dev/api/v3/private_message/" endpoint for example, would let someone read the private messages someone has send/received
I'm not sure whether someone could do POST requests and add credentials from the cookiejar this way though