Re: [Doh] notes on CORS and DoH

[Star Brilliant <[e-mail]>]

On Wed, Nov 7, 2018 at 7:49 PM Tony Finch <[e-mail]> wrote:
>
> I've amended my `doh101` implementation to support cross-origin requests
> from browsers.
>
> https://github.com/fanf2/doh101/
>
> DoH GET requests count as "simple requests" from the point of view of
> CORS, so they do not require any special support on the server to be
> available to any web page. However, because query strings are usually
> logged by web servers, DoH GET requests have somewhat worse privacy
> properties than POST requests. So it seemed to be worth implementing CORS,
> so that POST is available wherever GET is.
>
> What I've done is add `Access-Control-Allow-Origin: *` to regular DoH
> responses, and I added support for OPTIONS requests which reply with:
>
>    Access-Control-Allow-Origin: *
>    Access-Control-Allow-Methods: OPTIONS, HEAD, GET, POST
>    Access-Control-Allow-Headers: Content-Type
>    Access-Control-Max-Age: 86400
>
> It's roughly in line with what Cloudflare does for
> https://cloudflare-dns.com/dns-query
> (Except I'm using a longer method list which matches what I return
> for 405 method not allowed errors.)
>
> I've had a very brief look at some of the DoH servers listed at
> https://github.com/curl/curl/wiki/DNS-over-HTTPS#doh-tools
> and CORS support seems to be relatively rare.
>
> Tony.
> --
> f.anthony.n.finch  <[e-mail]>  http://dotat.at/
> Fisher, German Bight: Southeast 5 to 7, veering south or southwest 4 or 5.
> Moderate or rough. Showers. Good occasionally poor.


Hello Tony,

Thank you for your reminder!

I also amended my implementation [1]. The code is pending to be released before I test it through-out.

I consider there are no security issues with CORS.
But, does the browser-side cache work for a single URL or a whole site? Will it be a problem if a DoH server shares the same hostname with another website?

Best regards,
StarBrilliant

[1]: https://github.com/m13253/dns-over-https/commit/4754aa0414840349dc22a11b954d5f2c8243cf00