How secure is github's whitelisting CORS domains?

Question

The Github API allows you to make requests using CORS [1]. The CORS requests are only allowed by certain whitelisted domains :

Any domain that is registered as an OAuth Application is accepted.

I observe the following:

1. The whitelisted listed of domains is completely arbitary. Anyone could setup a github oauth application for any domain. [2], without any sort of domain verification in place. This means things like localhost, dropbox.com are already whitelisted.
2. The whitelisting loses all sense for a person with a malicious intent, since they can just fake the Origin headers for any app/domain.

The HTML5 Security Guide has the following points on the CORS security: [3]

1. An attacker could use Javascript with CORS requests to make the attacks appear to originate from the victim. (Point 3 in Universal Allow).
2. A certain amount of trust is placed on the origin header.

   There is a certain amount of trust placed on the Origin’ header. If the basis of this trust is not fully understood then it is possible to make mistakes. The Origin’ header only indicates that the request is from a particular domain, it does not guarantee this fact. The request could actually be from a Perl script which spoofs the Origin header.

In the case of github:

1. A person needs to only register a domain (or use already whitelisted domains such as dropbox.com) to get their CORS Requests to work. This could still lead to a "pure html" attack scenario above.
2. All of github's API is already available via JSONP as well [4]. Even unauthenticated, meaning the "pure html" attack could happen in any case.

My question is : Does Github gain anything (from a security point) by whitelisting domains (for API Access) or is it just a misplaced sense of security?

Answer 1

Allowing any domain CORS access to GitHub's API isn't a huge security concern.

GitHub wants full control over who has access to their API. The first step is that you have to contact GitHub in order to be added to their CORS API whitelist:

Please contact us to request white listed access for your application. We prefer sites that setup OAuth applications for their users.

This allows GitHub to enforce this part of their Terms of Service:

Abuse or excessively frequent requests to GitHub via the API may result in the temporary or permanent suspension of your account’s access to the API. GitHub, in its sole discretion, will determine abuse or excessive usage of the API. GitHub will make a reasonable attempt via email to warn the account owner prior to suspension.

GitHub reserves the right at any time to modify or discontinue, temporarily or permanently, your access to the API (or any part thereof) with or without notice.