Not sure I agree with you. The ACAO header is not to prevent the client
from accessing data on your server, but rather to warn the client that they
are connecting to a server that doesn't expect their request. Usually when
you use a browser, you trust its code, and trust it to warn you that
unexpected connections are taking place. Granted, a hacker can set up a
server with * origin access and inject javascript in any web page and the
browser won't say a peep.

The standard is to not send the header if it isn't set, which is the same
as 'same domain'. Up to you.

On Tue, Mar 12, 2013 at 2:21 PM, David Ellis <notifications@github.com>wrote:

> In lib/transports/server/middleware.js:
>
> > +
> > +// Connect/Express middleware style JSON-RPC server transport
> > +// Let's you have a hybrid Connect/Express server that also performs JSON-RPC
> > +// on a particular path. Still done as an instance so you can conceivably have
> > +// multiple JSON-RPC servers on a single Connect/Express server.
> > +function MiddlewareTransport(config) {
> > +    // Initialize the EventEmitter for this object
> > +    EventEmitter.call(this);
> > +
> > +    // Make sure the config object exists, the handler function exists,
> > +    // and the Access-Control-Allow-Origin header is properly set. Also
> > +    // allow the user to provide a reference to the underlying HTTP server
> > +    // so the ``shutdown`` method can work as expected, if desired.
> > +    config = config || {};
> > +    this.handler = function fakeHandler(json, next) { next({}); };
> > +    this.acao = config.acao ? config.acao : "*";
>
> ACAO is security-by-stupidity, to be honest with you. You have to *trust*the client to obey the ACAO directives to not access things they aren't
> supposed to, which you can't do because older browsers and anyone with
> curl/wget can bypass them anyways and hand-craft malicious requests.
>
> Your server security needs to be enforced on the server-side, not the
> client-side, so this ACAO configuration is just to placate Firefox (the
> ones that started this nonsense). You're no less secure with ACAO: "*" than
> with restricting the ACAO value, but just making things more difficult on
> yourself and possibly your own users if you forgot to include a subdomain
> in the ACAO listing and missed it during testing, which makes it the same
> kind of "security" as DRM.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/uber/multitransport-jsonrpc/pull/12/files#r3344037>
> .
>