Cross-Origin Resource Sharing (CORS)

Hacking 101 Web App Attack


Same Origin Policy prevents one origin from accessing resources on a different origin, this includes JavaScript & HTTP Requests.

Requests made by

URLResultReason Origin
**http:**// Schema and Port
https://**api** Domain**:8443**/fileBlockedDifferent port
https://**b**.com/analyticsBlockedDifferent Domain

Please note images and iframes are always allowed.

CORS headers start with “Access-Control”

Describes which origin can access the response. It’s the most improtant, because it’s the whitelist of what origins can access resources at this host.
[[ *, an origin, or “null” ]] is open for that request’s host.

Indicates if the request can include credentials ← !!!!

Instructs the browser to expose certain headers to JavaScript.

Instructs the browser to cache the CORS configuration for X seconds.

Standard GET, HEAD, and POST requests don’t require preflight requests.
Other request methods, requests with custom HTTP headers, or POST requests with non-standard content-types will require a preflight request.

Using the HTTP method OPTIONS for a request lets you know what methods are accepted.

Leave a Reply

Your email address will not be published. Required fields are marked *