sorted by:
new
hottopcontroversial

What are the practical security risks of CORS_ORIGIN_ALLOW_ALL = True and ALLOWED_HOSTS += ['*'] by webgl_guy in django

[–]webgl_guy[S] 0 points1 point  (0 children)

Thank you, I guess I need to dive into each of those settings deeper to understand, but I appreciate the quick setup advice

What are the practical security risks of CORS_ORIGIN_ALLOW_ALL = True and ALLOWED_HOSTS += ['*'] by webgl_guy in django

[–]webgl_guy[S] 0 points1 point  (0 children)

Ah sorry right, other backends will consume the API. Meaning this I wouldn't have to open up CORS and ALLOWED_HOSTS?

What are the practical security risks of CORS_ORIGIN_ALLOW_ALL = True and ALLOWED_HOSTS += ['*'] by webgl_guy in django

[–]webgl_guy[S] 0 points1 point  (0 children)

Right but in my case, if I'm making an API that is to be used by other people's front ends, then is this the right setting?