在哪些情况下，可以禁用浏览器的同源策略？

Question

I want to make a HTTP GET request to a site in a different domain than the client site. The final objective is to display a dashboard in the client site for the data that in the source site. The server of the source site is not configured for CORS and therefore it's not possible to make a simple AJAX call using JavaScript.

So I have two options, either to set up a proxy or disable Same Origin Policy for the browser. This dashboard is to be displayed on a dedicated machine on a common display. Is it okay to disable Same Origin Request restriction for the browser since it's only used for this purpose? Thanks.

Answer 1

You have another option that you didn't mention: get the data from the external site server-side, and pass it to your own dashboard. This btw, is the preferred way.

Answer 2

You can disable it, but you need to understand the consequences. The main goal of the single-origin-policy is to help prevent XSS attacks. The SOP protects users from unknowingly having malicious AJAX making requests on their behalf.

With Cross-Origin-Resource-Sharing disabled, if malicious JavaScript is injected into a browser session, say through an ad network, then that JavaScript would be blocked from things like connecting to the user's online banking page.

When you indiscriminately bypass the SOP in a browser, then any browsing session can be attacked in this way. If you're on a secure network and can guarantee that your site isn't compromised, and the browser won't be used for other purposes, then-and-only-then you are guaranteed to be safe.

On the other hand, as soon as someone uses that browser to connect to an unknown site, you have opened an attack vector. It's probably best not to mess with that setting, but only you can determine what is best for your specific scenario.