Scoping cross-site access for the Couri certified badge
Why the Couri badge is open to other websites while the rest of the API keeps strict browser security.
What I tried
The certified badge is the product, shown in footers on other people's pages. The API ran strict browser security settings across the board.
Why I chose differently
Strict defaults assume content stays on its own site, while a badge lives on customers' sites. Only a browser enforces the difference.
What I chose
I opened cross-site access for exactly the content meant to be embedded and kept the strict default everywhere else. The badge shows in every browser.
The principle
Security defaults are right to be strict. Loosen them for the paths that need it and nowhere else.
- Cross-Origin-Resource-Policy
- helmet
- Browser security
- HTTP headers