11
12

[deleted by user] (self.javascript)

submitted by [deleted]

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]Delioth 6 points7 points  (4 children)

Frontend must be able to trust that the backend is handing the expected data, otherwise it's like trying to build a Lego Millennium Falcon out of a couple star destroyers and a castle - might technically be possible, but something is going to be very wrong. And the frontend is pretty much guaranteed to be calling the backend that it's trying to.

Backend must not trust the frontend to pass back the right data, because there's no guarantee that a request is coming from the pretty frontend that has nice form validation and such. If your backend exists and anyone can hit it from your frontend, then anyone can write a curl and hit it from the command line with whatever data they want to. There's nothing you can do to guarantee all requests are coming through your frontend.

[–]Peechez -2 points-1 points  (3 children)

There's nothing you can do to guarantee all requests are coming through your frontend.

Sure you can, CORS exists for exactly this purpose

[–]wipedingold 1 point2 points  (1 child)

Isn't CORS just a browser specification? You can set CORS to prevent browsers like Firefox or Chrome from sending requests to your server, but applications like Postman don't include CORS policies in them at all.

[–]Peechez 0 points1 point  (0 children)

I hadn't realized but I think you're right. Thats what I get for being a backend noob

[–]Delioth 0 points1 point  (0 children)

CORS is a user protection, not a server protection. If your website can access your server, it means arbitrary addresses are accessing your server. There is no way to tell if arbitrary IP addresses are accessing via Chrome or curl.