The Github API allows you to make requests using CORS . The CORS requests are only allowed by certain whitelisted domains :
Any domain that is registered as an OAuth Application is accepted.
I observe the following:
- The whitelisted listed of domains is completely arbitary. Anyone could setup a github oauth application for any domain. , without any sort of domain verification in place. This means things like
dropbox.comare already whitelisted.
- The whitelisting loses all sense for a person with a malicious intent, since they can just fake the Origin headers for any app/domain.
The HTML5 Security Guide has the following points on the CORS security: 
- A certain amount of trust is placed on the origin header.
There is a certain amount of trust placed on the Origin’ header. If the basis of this trust is not fully understood then it is possible to make mistakes. The Origin’ header only indicates that the request is from a particular domain, it does not guarantee this fact. The request could actually be from a Perl script which spoofs the Origin header.
- A person needs to only register a domain (or use already whitelisted domains such as dropbox.com) to get their CORS Requests to work. This could still lead to a "pure html" attack scenario above.
- All of github's API is already available via JSONP as well . Even unauthenticated, meaning the "pure html" attack could happen in any case.
My question is : Does Github gain anything (from a security point) by whitelisting domains (for API Access) or is it just a misplaced sense of security?