search

Rob--W / cors-anywhere

CORS Anywhere is a NodeJS reverse proxy which adds CORS headers to the proxied request.
MIT License
8.57k stars 5.99k forks source link

#400 add support to preserve set-cookie response headers #401

Closed DovOps closed 2 years ago

Rob--W commented 2 years ago

Something like this has been attempted before by others. I strongly recommend against using this in this way, because the implementation is flawed and a security risk. See https://github.com/Rob--W/cors-anywhere/pull/154#issuecomment-468649353 and the referenced comments for more background.

DovOps commented 2 years ago

@Rob--W - thanks for the comments. I understand the general risks associated with 'productionizing' this, but I've found it useful when doing local development only, in order to get certain APIs to work in local browsers at development time. In this particular case the auth that took place with the target service leveraged cookies, and therefore I needed them proxied over in order to do development against this service.

ahmafi commented 1 year ago

Yeah, I wanted this for local development only, don't know what others doing for this. But maybe this could be added with a good exposure of how dangerous this is. For example, React has a prop called dangerouslySetHtml which signifies that it is dangerous, but still possible for rare use cases.