I am confused about why websites use CORS. I know CORS provide some protocols through which website can call the resources from other domains, but is it possible to call the resource without CORS?

If it is, then what vulnerability can it cause?

  • CORS lets browsers do the same thing as curl or php, within the spec. – dandavis Sep 19 '17 at 19:36

You can send GET and POST requests cross domain even if the target does not use CORS, but there are some restrictions. Most importantly, you can not read the response. This restriction is built into browsers as part of the Single Origin Policy (SOP) and it protects against data leaking across domains. However, it also stops you from publiching an API that can be read from any domain.

CORS gives you the option to remove that restriction, i.e. allowing the domain that is hosting the API to announce to browsers that it allows cross domain calls from either all or some domains. So I wouldn't say CORS is protecting against a specific vulnerability. Rather it allows you to open your API:s up to the world. Not having a CORS policy at all will always be the most restrictive option.

For more reading on CORS I recommend Mozilla and HTML5 Rocks.

  • By reading your answer i got that, browser set the SOP automatically. – Utkarsh Agrawal Sep 19 '17 at 12:40
  • can you please define the work of the img src in the html page, I mean when you got to the source code in the website and you see their are lot of img src and script src files there, so how they work.? And i think they work without CORS? So can you plz define it, I hope you get my point.. ;) – Utkarsh Agrawal Sep 19 '17 at 12:44
  • An ordinary GET request for an image requires no CORS. But if foo.com/index.html includes the image bar.com/image.png, Foo can not read the content of the image. Sure, it is displayed, but the browser will not let Foo read the content using e.g. getImageData. – Anders Sep 19 '17 at 13:33
  • Okay its interesting to ask you question so this is last one :P, i have read about how to abuse the CORS, but i want to know in the Real world CORS abusing, i mean when attacker changes the origin header let's say example.com to attacker.com , if the origin header (attacker.com) is reflected back then that's it, attacker now read out the contents of the web page. Is this how we can abuse this? – Utkarsh Agrawal Sep 19 '17 at 13:48
  • No, you can't abuse it that way. The browser will not let you change the origin header. Sure, you could do it on your own computer with curl or something, but that would be pointless since you wouldn't have access to the victims cookies etc. – Anders Sep 19 '17 at 13:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.