http://localhost:8080/* breaks authenication

[Goosaroo]

Hi all,

Great to see this new release with WkWebView.

We are running into a minor issue with our authentication provider, which throws an origin error: http://localhost:8080 is not allowed by Access-Control-Allow-Origin. Of course we could add it as a trusted source, however we would rather keep things tight from a security point of view.

So I am wondering why does this needs to be added to the config.xml and is there a way around it?

Cheers, G

[awebdeveloper]

as in the other post. domain as ionic.local is better

[Goosaroo]

Hi @awebdeveloper,

You mean like? <allow-navigation href="ionic.local"/>

Couldn't make this up from the other post.

Cheers, G

[tanzl88]

Hi @awebdeveloper,

I resolved it by allowing CORS to localhost:8080 too. But as you said it is not recommended. I want to understand why origin is set to localhost:8080 instead of *. I don't understand what you meant by ionic.local as well.

[awebdeveloper]

i was refering to #3 (comment)

[peterpeterparker]

same here, on my server I get http://localhost:8080 as origin instead of ionic.local

app.use(function (req, res, next) {
    console.log(req.headers.origin); // => http://localhost:8080
}

[manucorporat]

I don't know what kind of security you are talking about, but the point of CORS is to prevent Cross Origin attacks:

For example, someone injects malicious code in your side that performs HTTP requests to a different domain. Read this: https://blog.cloudflare.com/an-introduction-to-javascript-based-ddos/

ionic.local is not less or more secure than localhost. Anyone can modify the /etc/hosts file.
C'mon! I can attack your site bypassing CORS completely if I use curl.

WK 3.0 used a local webserver, because it is the only solution that works for all the use cases.

[awebdeveloper]

OK agreed with all except para 2.

But y did u change from ionic.local to localhost

[manucorporat]

@awebdeveloper
because of this: https://docs.google.com/document/d/19VQ-n7hGr9IDPPstQqU8_8WgqUh7R6sgQfL2neoT-Xw/edit?usp=sharing

[manucorporat]

WKWebView is fully of little bugs, that makes it very difficult to use, localhost is the only solution that works for all use cases

[awebdeveloper]

Thanks @manucorporat. Now I understand why localhost.

Still don't think para 2 is correct. CSP is for para 2 . Cors is entirely server thing. Hacker could inject js and whitelist it on his server

[awebdeveloper]

I guess this can be closed