The Github API allows you to make requests using CORS [1]. The CORS requests are only allowed by certain whitelisted domains :

Any domain that is registered as an OAuth Application is accepted.

I observe the following:

  1. The whitelisted listed of domains is completely arbitary. Anyone could setup a github oauth application for any domain. [2], without any sort of domain verification in place. This means things like localhost, dropbox.com are already whitelisted.
  2. The whitelisting loses all sense for a person with a malicious intent, since they can just fake the Origin headers for any app/domain.

The HTML5 Security Guide has the following points on the CORS security: [3]

  1. An attacker could use Javascript with CORS requests to make the attacks appear to originate from the victim. (Point 3 in Universal Allow).
  2. A certain amount of trust is placed on the origin header.

    There is a certain amount of trust placed on the Origin’ header. If the basis of this trust is not fully understood then it is possible to make mistakes. The Origin’ header only indicates that the request is from a particular domain, it does not guarantee this fact. The request could actually be from a Perl script which spoofs the Origin header.

In the case of github:

  1. A person needs to only register a domain (or use already whitelisted domains such as dropbox.com) to get their CORS Requests to work. This could still lead to a "pure html" attack scenario above.
  2. All of github's API is already available via JSONP as well [4]. Even unauthenticated, meaning the "pure html" attack could happen in any case.

My question is : Does Github gain anything (from a security point) by whitelisting domains (for API Access) or is it just a misplaced sense of security?


Allowing any domain CORS access to GitHub's API isn't a huge security concern.

GitHub wants full control over who has access to their API. The first step is that you have to contact GitHub in order to be added to their CORS API whitelist:

Please contact us to request white listed access for your application. We prefer sites that setup OAuth applications for their users.

This allows GitHub to enforce this part of their Terms of Service:

Abuse or excessively frequent requests to GitHub via the API may result in the temporary or permanent suspension of your account’s access to the API. GitHub, in its sole discretion, will determine abuse or excessive usage of the API. GitHub will make a reasonable attempt via email to warn the account owner prior to suspension.

GitHub reserves the right at any time to modify or discontinue, temporarily or permanently, your access to the API (or any part thereof) with or without notice.

  • Your first quote is from the Rate Limit section of the API. I think white-listing in that section stands for "over-rate-limit". And JSONP API access means that anyone could use the API w/o creating an account/application (they can't enforce ToS) Also, as my question points out[2] , you don't have to contact github, merely create an oath application for adding your domain to the whitelist. – Nemo Jul 15 '12 at 8:48
  • You are probably right about the ToS enforcing part, but you don't have to contact github to get into CORS whitelist. You just go to github.com/settings/applications and create an application. Which is why I think that the contact for whitelisting point is about rate limits, not cors whitelist. Also see the commit message at github.com/github/developer.github.com/commit/… makes it pretty clear. – Nemo Jul 15 '12 at 10:02
  • @Capt.Nemo doesn't matter, it still about controlling access to the api to limit abuse. – rook Jul 15 '12 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.