4

I was testing an internal application recently, that had fully permissive CORS, i.e. it echoes the Origin header into Access-Control-Allow-Origin, has Access-Control-Allow-Credentials: true and handles OPTIONS properly. All the pieces were in place - but I couldn't get a POC to work. Both Chrome and Firefox were simply sending the cross-origin request without a preflight, and without attaching credentials (and yes, I had set withCredentials on the request).

Seems to me that there is some kind of security control in place to stop internet sites attacking intranet sites? I couldn't find any info on such a filter online, and I'm not entirely sure how it would work - although I can see that it would be a good security feature. Possibly this feature has broader applicability than just CORS.

There was no "fancy stuff" enabled like CSP or CORB.

Improve this question
3
  • How does the target site authenticate? Does it use cookies? Basic authentication? A JWT in a header?
    – Sjoerd
    Commented Sep 11, 2023 at 14:42
  • @Sjoerd cookies
    – paj28
    Commented Sep 11, 2023 at 14:46
  • Are you familiar with Private Network Access?
    – jub0bs
    Commented Sep 25, 2023 at 18:32

2 Answers 2

Reset to default
5

I suspect that the problem has nothing to do with CORS but that it is instead related to the SameSite attribute of the cookie used for authentication. Since a while now modern browsers will no longer send cookies cross-site, unless they are explicitly declared for cross-site use with SameSite=None; Secure.

Note that for this attribute it makes no difference if the target site is internal or not. But that your problem is specific for the access from external to internal site seems to be only an assumption you have made, i.e. there is no indication that the problem you face is actually related to this.

Improve this answer
4
  • 1
    Ah, that'll be it, SameSite defaulting to Lax now. Thanks
    – paj28
    Commented Sep 11, 2023 at 15:16
  • 1
    @paj28 My fix for the same issue, rather than setting Lax, was to have a standalone page (not connected to the rest of the CMS, so it doesn't set a new session cookie if it's missing), which just receives the post and get data in a hidden form and posts it on again to the script which actually deals with it.
    – TRiG
    Commented Sep 12, 2023 at 16:59
  • 1
    @TRiG So that's what that is! Loads of websites do that, but I never quite understood why.
    – wizzwizz4
    Commented Sep 12, 2023 at 18:57
  • I was getting very weird errors from shopping carts after the 3D Secure step, and that fixed it. Have had to do it for a couple of other APIs too, since then. @wizzwizz4.
    – TRiG
    Commented Sep 12, 2023 at 21:25
4

Currently there are no restrictions on CORS-mode requests to intranet sites, but there are plans to implement those:

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .