Contrary to what the doc claims, CORS is no defence

[jub0bs]

The file content/docs/operating/security.md contains the following passage:

For non-mutating endpoints, you may wish to set CORS headers such as Access-Control-Allow-Origin in your reverse proxy to prevent XSS.

However, this passage is problematic, because CORS is no defence against XSS. In fact, CORS is no defence at all; quite the opposite, since its goal is to relax the Same-Origin Policy.

This passage should be reworded or even removed.

[jan--f]

Hello from the bug scrub. @jub0bs Do you have any proposal on how this can be reworded?

[jub0bs]

@jan--f Hi! Yes: don't mention CORS as a defence against XSS. If you wish to defend against XSS (or any attack, really), CORS is not the right tool.