I recently shared a notebook with a mailing list, and one of the list members objected to the “security blunder” of pulling in resources from Gist and jsdeliver. This particular person runs NoScript on Firefox, it should be said. By design, Observable is friendly to pulling resources from other si…

Observable’s security model is that notebook content runs in a sandboxed, crossorigin iframe. This prevents any malicious content in notebooks from being able to access the surrounding page, so the risk of malicious JavaScript modifying the Observable UI, stealing credentials, or other nefarious act…

The other thing I would advise here, both for security and more generally for reliability, is version pinning. For example, if you are loading a data file from a Gist, you can pin the exact SHA of the Gist version to guarantee that it won’t change. Similarly when you require a JavaScript library, yo…

I don’t follow what this has to do with CORS I guess. I mean, everything tom and Mike said makes sense, but doesn’t really have anything to do with CORS, the same sorts of things apply for loading a script tag you don’t host yourself etc. I thought CORS protects you against sites “hijacking” an exis…

Ah, you’re right. I wasn’t able to trigger the error earlier without opening a private window (probably due to caching).

I think you mistakenly replied on this thread, FYI. You might want to reply again on the correct one… though it looks like @bgchen followed the thread here successfully.

Thank you, Mike and Tom, for the good information and advice. @davertron , I probably should not have put CORS in the title; I confess I have trouble separating the different scenarios in my head. They seem linked because the same-origin policy favors “self-contained” sites, those which clearly are…

Tom, that’s great to hear. Yes, I imagine the modern web must be quite unpleasant to someone using NoScript. Evidently NoScript does not distinguish requests coming from inside an iFrame. Even if it did, I suspect that would still fail to combat the FUD involved. Can the same assurance be provid…

The Same Origin Policy (SOP) is the policy browsers implement to prevent vulnerabilities via Cross Site Scripting (XSS). In other words, the browser would not allow any site to make a request to any other site. It would prevent different origins from interacting with each other through such requests…

CORS and User Trust

Help

mootari September 27, 2019, 1:14pm 2

Did that person happen to expand on their concerns and expectations? Or did they refuse to turn off / adjust NoScript out of principle?

Topic		Replies	Views
Private CORS Proxy for Paid Users? Feedback	2	316	January 26, 2024
CORS problems embedding via runtime Help	3	576	November 22, 2021
dynamic import breakage / cross-origin frame issue Help	5	1605	January 10, 2023
HTTPRequest Origin="null" Help	19	25960	October 11, 2021
Suggestion: proxy calls to private-per-user-per-notebook whitelisted urls	1	1024	August 20, 2019

CORS and User Trust

Related topics