1

I have one website in chromium tab, and an other website in another tab, Im executing single post command in the second website - $.post(...); to the first website. Originaly its not working (getting: "No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin ‘null’ is therefore not allowed access") ,but if runing chromium with "--disable-web-security --user-data-dir=~/.chrome-tmp " flags it will send the post. the question is, what exactly changed so after putting those flags the post is sent ? I first thought that it disabled "same origin policy" but after some reading it seems like it has nothing to do with it.

  • Cross-domain POST requests are always allowed. – Arminius Jul 13 '17 at 0:44
3

The --disable-web-security flag will prevent Chromium from enforcing the same-origin policy (SOP), which will allow you to read the response of your cross-origin POST request.

However, do note that the POST request is always sent, regardless of same-origin policy. Anything that takes place on the server for that request will still happen (creating a resource, updating something, etc.) This is what is meant by cross-domain writes are allowed:

The simplest explanation of SOP is that Origin “A” has the following permissions:

  • Read of resources from Origin “B”: Deny
  • Write to Origin “B”: Limit
  • Execute of resources from Origin “B”: Allow

Source: https://blogs.msdn.microsoft.com/ieinternals/2009/08/28/same-origin-policy-part-1-no-peeking/

More explanation about "limited write" can be found on part 2 of that blog post.

Mozilla's documentation also explains it well, using different terminology. (jQuery's $.post uses XMLHttpRequest)

The same-origin policy controls interactions between two different origins, such as when you use XMLHttpRequest or an <img> element. These interactions are typically placed in three categories:

  • Cross-origin writes are typically allowed. Examples are links, redirects and form submissions. Certain rarely used HTTP requests require preflight.
  • Cross-origin embedding is typically allowed. Examples are listed below.
  • Cross-origin reads are typically not allowed, but read access is often leaked by embedding. For example you can read the width and height of an embedded image, the actions of an embedded script, or the availability of an embedded resource.

Source: https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy#Cross-origin_network_access

  • But the fact is - I tried commenting from external page on the original one, and the comment wasnt posted up until I used the flags, why ? – דניאל ניסחיזוב Jul 13 '17 at 6:01
  • @דניאלניסחיזוב I can't tell without looking at the code. Have you tried inspecting the Network panel in the DevTools to see what is being sent? If you are in control of the web site that you are posting to then you can also debug stuff on the server side (logs, etc.) – rink.attendant.6 Jul 13 '17 at 6:04
  • Actually i did, the "No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin ‘null’ is therefore not allowed access" message is shown @rink.attendant.6 – דניאל ניסחיזוב Jul 13 '17 at 7:24
  • @דניאלניסחיזוב That means the response from the server doesn't have the Access-Control-Allow-Origin header... and you'd only get a response from the server if the request was sent – rink.attendant.6 Jul 18 '17 at 15:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.