Enabling Cross-origin resource sharing (DISCOURSE_ENABLE_CORS) allows JavaScript API requests from domains other than where Discourse is hosted. This can be useful for embedding topic lists or making API calls with JavaScript. However, enabling CORS poses security risks.
According to sam, enabling CORS, especially for all domains (*), is a bad idea due to the importance of the same-origin policy [1]. Even allowing a single domain can be risky if you don’t control the site sam.
A safer alternative to enable API access from a different domain is to use JSONP, either by origin domain or by API username/key meglio. This method has been discussed in another topic [2], but its implementation status is unclear.
So, there is a way to allow JS API requests from domains other than where you Discourse is hosted.
For example, you’d like to embed a topic list that is a result of search by some criteria - and you want to do it with JavaScript only, making it call your Discourse’s API.
For this to work, you’ll need to enable Cross-origin resource sharing:
For a multi-site setup, you can also use a per-instance setting:
Now The Question: Are there ANY risks by enabling it?
Be it tiny, small, medium or large, may you elaborate please - which are the risks, drawbacks or other negative sides of enabling cross-origins for a particular domain.
