As there is an option to disable HTTP access control (CORS) in browsers, so I can send requests to any origin. So why should I bother to run a Browser with CORS enabled?

  • It's mainly to protect copyright owners against deeplinking and client-side scraping.
    – dandavis
    Sep 29 '17 at 20:59
  • 1
    A modern web application typically has frontend code and a backend API. The frontend code is static HTML, Javascript and CSS. You could just copy that static code and host it under a different domain, and still use the same backend API. CORS prevents that. Sep 2 '19 at 18:39
  • What does that have do with anything the question says?
    – yeah_well
    Sep 2 '19 at 18:44
  • If sites can be spoofed, it's in the user's best interest to have CORS enabled. Sep 2 '19 at 18:47
  • Ok, but the sites are separated from eachother, i.e. the Javascript of a malicious site can't affect another. Except some very tricky things, like posting forms.
    – peterh
    Sep 3 '19 at 6:18

For your own good.

If you disable CORS the following can happen:

I send you link to a page called hackfacebook.com for example. When you visit my page, I then request the facebook.com page using an AJAX request which if you are logged in returns the page content as well as your session cookie.

I now as the owner of hackfacebook.com have your login session.

As you can see disabling CORS is at your own risk as it can open up another attack.

  • I though that it is for protecting serve resources ... like REST apis
    – tprieboj
    Sep 29 '17 at 14:56
  • 1
    can one read cookies cross-domain like that?
    – dandavis
    Sep 29 '17 at 20:59
  • @dandavis If you have disabled the SOP by allowing cross domain requests without CORS, then yes you can. Just read the response headers.
    – Anders
    Oct 13 '17 at 5:58
  • @Anders: i figured "disabling CORS" != "disabling SOP", so i would expect fewer "perms", not more...
    – dandavis
    Oct 13 '17 at 6:06
  • @dandavis Yeah, the wording is a bit vague here. I would take "disable CORS" to mean "disable the requirement to get permission via CORS before giving access to the contents of cross domain requests".
    – Anders
    Oct 13 '17 at 6:27

The purpose of CORS is to prevent a web browser that respects it from calling the server using non-standard requests with content served from a different location.

Standard requests are basically

  • GET
  • HEAD
  • POST (but only certain types like application/x-www-urlencoded, i.e. not application/json)

With just the limited set of standard headers. Anything outside those constraints will trigger a CORS check via an OPTIONS call.

  • you only describe the preflight check, you don't really answer the question.
    – dandavis
    Oct 13 '17 at 6:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.