As there is an option to disable HTTP access control (CORS) in browsers, so I can send requests to any origin. So why should I bother to run a Browser with CORS enabled?

  • It's mainly to protect copyright owners against deeplinking and client-side scraping. – dandavis Sep 29 '17 at 20:59

For your own good.

If you disable CORS the following can happen:

I send you link to a page called hackfacebook.com for example. When you visit my page, I then request the facebook.com page using an AJAX request which if you are logged in returns the page content as well as your session cookie.

I now as the owner of hackfacebook.com have your login session.

As you can see disabling CORS is at your own risk as it can open up another attack.

  • I though that it is for protecting serve resources ... like REST apis – TomP Sep 29 '17 at 14:56
  • can one read cookies cross-domain like that? – dandavis Sep 29 '17 at 20:59
  • @dandavis If you have disabled the SOP by allowing cross domain requests without CORS, then yes you can. Just read the response headers. – Anders Oct 13 '17 at 5:58
  • @Anders: i figured "disabling CORS" != "disabling SOP", so i would expect fewer "perms", not more... – dandavis Oct 13 '17 at 6:06
  • @dandavis Yeah, the wording is a bit vague here. I would take "disable CORS" to mean "disable the requirement to get permission via CORS before giving access to the contents of cross domain requests". – Anders Oct 13 '17 at 6:27

The purpose of CORS is to prevent a web browser that respects it from calling the server using non-standard requests with content served from a different location.

Standard requests are basically

  • GET
  • HEAD
  • POST (but only certain types like application/x-www-urlencoded, i.e. not application/json)

With just the limited set of standard headers. Anything outside those constraints will trigger a CORS check via an OPTIONS call.

  • you only describe the preflight check, you don't really answer the question. – dandavis Oct 13 '17 at 6:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.