# What are the risks of enabling Cross-origin resource sharing (DISCOURSE\_ENABLE\_CORS)

**URL:** https://meta.discourse.org/t/what-are-the-risks-of-enabling-cross-origin-resource-sharing-discourse-enable-cors/41248
**Category:** Support
**Created:** [2016年三月18日 03:15 UTC](https://meta.discourse.org/t/what-are-the-risks-of-enabling-cross-origin-resource-sharing-discourse-enable-cors/41248 "2016-03-18T03:15:56Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![meglio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/meglio/32/71444_2.png) [@meglio](https://meta.discourse.org/u/meglio)
#### Post date: [2016年三月18日 03:15 UTC](https://meta.discourse.org/t/what-are-the-risks-of-enabling-cross-origin-resource-sharing-discourse-enable-cors/41248/1 "2016-03-18T03:15:57Z")

</div>

So, there is a way to **allow JS API requests from domains other than where you Discourse is hosted**.

For example, you’d like to embed a topic list that is a result of search by some criteria - and you want to do it with JavaScript only, making it call your Discourse’s API.

For this to work, you’ll need to enable Cross-origin resource sharing:

> [@techAPJ](#):
>
> How can I enable Cross-origin Resource Sharing with Docker?
> 
> Modify these settings in app.yml file:
> 
> DISCOURSE\_ENABLE\_CORS: true  
> DISCOURSE\_CORS\_ORIGIN: ‘\*’

For a multi-site setup, you can also use a per-instance setting:

![](https://global.discourse-cdn.com/meta/original/3X/9/2/92a4d1883702f745e59cd864e0530ca3495149ec.png)

(…see more [here](https://meta.discourse.org/t/what-is-the-purpose-of-settings-security-cors-origins-vs-similar-environment-setting/35331))

Now The Question: Are there ANY risks by enabling it?

Be it tiny, small, medium or large, may you elaborate please - which are the risks, drawbacks or other negative sides of enabling cross-origins for a particular domain.

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [2016年三月18日 03:23 UTC](https://meta.discourse.org/t/what-are-the-risks-of-enabling-cross-origin-resource-sharing-discourse-enable-cors/41248/2 "2016-03-18T03:23:17Z")

</div>

See here:

> <https://security.stackexchange.com/questions/8264/why-is-the-same-origin-policy-so-important>

Bottom line, it is a very bad idea to enable \*

---

<div class="post-metadata">

### Author: ![meglio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/meglio/32/71444_2.png) [@meglio](https://meta.discourse.org/u/meglio)
#### Post date: [2016年三月18日 03:24 UTC](https://meta.discourse.org/t/what-are-the-risks-of-enabling-cross-origin-resource-sharing-discourse-enable-cors/41248/3 "2016-03-18T03:24:09Z")

</div>

In general, is still bad for enabling a single domain only?

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [2016年三月18日 03:25 UTC](https://meta.discourse.org/t/what-are-the-risks-of-enabling-cross-origin-resource-sharing-discourse-enable-cors/41248/4 "2016-03-18T03:25:28Z")

</div>

Allowing sites you do not control CORS access is a bad idea.

---

<div class="post-metadata">

### Author: ![meglio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/meglio/32/71444_2.png) [@meglio](https://meta.discourse.org/u/meglio)
#### Post date: [2016年三月18日 03:31 UTC](https://meta.discourse.org/t/what-are-the-risks-of-enabling-cross-origin-resource-sharing-discourse-enable-cors/41248/5 "2016-03-18T03:31:31Z")

</div>

So, the only really safe way to query API from a different domain would be to allow JSONP: either by origin domain or by api\_username/key, right?

If that’s correct, I’ve seen some discussion about JSONP in [this topic](https://meta.discourse.org/t/cross-origin-resource-sharing-for-api-access-in-javascript/6067) - have it been considered for implementation eventually?

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [2021年十二月28日 05:04 UTC](https://meta.discourse.org/t/what-are-the-risks-of-enabling-cross-origin-resource-sharing-discourse-enable-cors/41248/8 "2021-12-28T05:04:24Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.