Bumped by Community user
    Bumped by Community user
2 Corrected Grammar
source | link

CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers.

Can CORS Anywhere able to bypass CSRF protections?

#Why I am asking thisReason to ask the question here?:

Simple, for learning and also for breaking things and then applying a proper fix.

So I am testing my Collage's web site. to make it more secure. and after some time I Noticednoticed the application was preventing CSRF attacks by checking. the Content-Type:application/json header. 

It doesn't check CSRF tokens. I can use other users CSRF tokens in same requests.

What I tried:

Attempt:

I tried changing Content-Type:application/json to Content-Type:text/plain but it not worked. The response come as Content-Type:text/plain not allowed.

I also tried to changing the POST Method tomethod into GET but it alsodid not workedwork either. Also This

Also this site doesn't have crossdomain.xml File. So flash based trick no chance.

Thanks in advancedSuggestions are highly appreciated. :-)

CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers.

Can CORS Anywhere able to bypass CSRF protections?

#Why I am asking this question here?

Simple, for learning and also for breaking things and then applying a proper fix.

So I am testing my Collage's web site. to make it more secure. and after some time I Noticed the application was preventing CSRF attacks by checking. the Content-Type:application/json header. It doesn't check CSRF tokens. I can use other users CSRF tokens in same requests.

What I tried:

I tried changing Content-Type:application/json to Content-Type:text/plain but it not worked. The response come as Content-Type:text/plain not allowed.

I also tried to changing the POST Method to GET but it also not worked. Also This site doesn't have crossdomain.xml File. So flash based trick no chance.

Thanks in advanced. :-)

CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers.

Can CORS Anywhere able to bypass CSRF protections?

Reason to ask the question here:

Simple, for learning and also for breaking things and then applying a proper fix.

So I am testing my Collage's web site to make it more secure and after some time I noticed the application was preventing CSRF attacks by checking the Content-Type:application/json header. 

It doesn't check CSRF tokens. I can use other users CSRF tokens in same requests.

Attempt:

I tried changing Content-Type:application/json to Content-Type:text/plain but it not worked. The response come as Content-Type:text/plain not allowed.

I also tried changing the POST method into GET but it did not work either.

Also this site doesn't have crossdomain.xml File. So flash based trick no chance.

Suggestions are highly appreciated.

1
source | link

CORS Anywhere to bypass CSRF protection

CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers.

Can CORS Anywhere able to bypass CSRF protections?

#Why I am asking this question here?

Simple, for learning and also for breaking things and then applying a proper fix.

So I am testing my Collage's web site. to make it more secure. and after some time I Noticed the application was preventing CSRF attacks by checking. the Content-Type:application/json header. It doesn't check CSRF tokens. I can use other users CSRF tokens in same requests.

What I tried:

I tried changing Content-Type:application/json to Content-Type:text/plain but it not worked. The response come as Content-Type:text/plain not allowed.

I also tried to changing the POST Method to GET but it also not worked. Also This site doesn't have crossdomain.xml File. So flash based trick no chance.

Thanks in advanced. :-)