1.) Turns out this is no longer true because the cors issue is fixed as of two weeks ago.
But to answer your question:
Well that’s the really silly part about it. You see, the way CORS works is that it only works if the client making the request implements cors. In this case when I say client I’m talking about your web browser itself. Native applications, or hitting an API directly via network calls, don’t implement cors and thus you can make the calls all you want and the server responds. So even when cors was configured to only allow requests from the correct domain it only affected people with web browsers.
However two weeks ago a PR was merged into the Lemmy source code setting the cors to by default allow requests from anyone instead of a specific domain.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !technology@beehaw.org
A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.
Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.
I see, but how is this different in a phone app? Wouldn’t the request still be made to a backend?
1.) Turns out this is no longer true because the cors issue is fixed as of two weeks ago.
But to answer your question:
Well that’s the really silly part about it. You see, the way CORS works is that it only works if the client making the request implements cors. In this case when I say client I’m talking about your web browser itself. Native applications, or hitting an API directly via network calls, don’t implement cors and thus you can make the calls all you want and the server responds. So even when cors was configured to only allow requests from the correct domain it only affected people with web browsers.
However two weeks ago a PR was merged into the Lemmy source code setting the cors to by default allow requests from anyone instead of a specific domain.