Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'd like to track and understand if CORS/cross site requests are hitting my website, and if they are succeeding or failing.

My goal is to understand if clients are following our documentation correctly, and to detect attempts at hacking our site from a 3rd party.

I don't know if there is any value in reporting separately on a "preflight" CORS request versus a normal request, but it would be interesting to observe the result.

That being said,

  • What needs to be logged in normal IIS logs to detect this CORS and preflight requests?
  • Is any application-specific logging required? (logic in the web app itself to supplement the IIS logs)
share|improve this question

1 Answer 1

Well, there are two types of cross sites requests. One would be from your web pages to a separate domain and the other would be from outside domain web pages to your website.

Let's say that you are serving a web page from iis with a malicious image or script. When the user makes the request for that page iis can log all the http requests (images, scripts, html, etc) to it's own server but not to the malicious server. So you won't see any http requests in your iis logs. Capturing of http requests that happen from your web pages can only be done at the client level. Unfortunately, javascript does not have an api for capturing http request events but tools such as fiddler or firebug can show you all the http requests that are sent when a web page is loaded. For this scenario you may be able to achieve your desired results by scripting a crawl of your website and enumerating all the http requests that are made. You would then check if the domain of the request is your own and what the http response code is (success vs. failure).

The other scenario is if malicious data is being hosted and served from your website (e.g. someone uploaded some javascript and is calling it from another website). A simple way to detect this is to parse your iis logs looking for http requests to non-html file types with a referrer other than your own. The referrer can be spoofed if the attacker has enough foresight to do so. This can also be actively prevented via a http module, url rewrite rule or via your website code if you set up something to serve your files.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.