Hacker News Reader

Does what enforce it? The browser does, that's why you need to set CORS on your local node for it to work. What's the scenario you're thinking of?

View on HN

Different authors and documents are considered part of the same domain since the tokens are just path elements. The whole IPFS gateway might be considered one big domain.

So javascript in an essay can access/put the API.

I didn't really look into it too much, just wanted to give a pointer that this might need to be considered. In the sense that it might have security implications.

No, you're right in this, if you have it enabled, any app can put stuff to your endpoint. The people of IPFS are working on fixing this problem, but I personally think that the risk is low enough. Maybe I'm just not creative enough in thinking about attacks, though.

So in order for this to work through a gateway, that gateway needs to set the CORS headers, or?

No because you'll be fetching it from the gateway, and then writing to the same gateway. No cross-domain going on.

But then is it not a security problem that other IPFS apps retrieved through the same gateway will be seen by the browser as being of same origin?

Yes, for now. There is code existing to set the Suborigin header, but browser support is limited, and I'm not even sure if that code is merged into mainline IPFS yet.

Reply on news.ycombinator.com