Due to the current gap in continued funding from the U.S. National Science Foundation (NSF), the NSF Unidata Program Center has temporarily paused most operations. See NSF Unidata Pause in Most Operations for details.
Due to the current gap in continued funding from the U.S. National Science Foundation (NSF), the NSF Unidata Program Center has temporarily paused most operations. See NSF Unidata Pause in Most Operations for details.
Hi all, An honest (and perhaps innocent) question - if a server is already public and read-only, what is there to lose by enabling CORS? The cross-origin security constraints exist for the security of the client (browser), not the server. You could after all be accessing the server through something that isn't a browser at all. However, if a server requires logins, and/or allows changes to the server to be made through the web interface, then CORS is perhaps more of an issue (most of the examples in the website Dennis quotes are around these use cases). >From that same website, the risk of allowing CORS for a public read-only site >appears to be that an attacker could use users' web browsers to perform a >distributed denial-of-service attack, which is surely already possible anyway >(and is why many sysadmins implement throttling or some other strategy). Cheers, Jon (not a security expert or a sysadmin!)
thredds archives: