1

I made a XHR cross-origin request from a html file, hosted on a python Simple HTTP Server.

var xhr = new XMLHttpRequest();
xhr.open("GET", "https://www.facebook.com/favicon.ico", true);
xhr.withCredentials = true;
xhr.onload = function () {
    console.log(xhr.responseText);
};
xhr.send();

I open Chrome developer tools and watch the requests through Network tab. In the Network tab I see a single direct request made to the server "facebook.com".

XHR Cross-origin Request

The behaviours which I found unusual were:

  1. I was hoping to see a preflight request before the direct XHR request was made, according to the documentation mentioned here: link

  2. The request got a status code: *200** which is unusual. SOP should block such kind of request since it is a cross-domain request.

However, In Console tab of Chrome developer tools, I see the expected behaviour:

XHR Cross-Origin Request denied access

2

A preflight request to check for CORS headers is only done if the request done with XHR could not be achieved without XHR. In your case you are just doing a simple GET request with no special headers which could be done also by including an image with the same URL or similar. Thus the request does not need to be preflighted.

For more details which request are considered "simple" and get not preflighted and which requests are not simple see Preflighted Requests in the documentation to CORS at Mozilla Developer Network.

  • 2
    To answer the second question: The server can return any status code it wants, but unless the right CORS headers are there, the browser will not give your script access to the content of the response. – Anders Feb 28 '17 at 12:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.