As there is an option to disable HTTP access control (CORS) in browsers, so I can send requests to any origin. So why should I bother to run a Browser with CORS enabled?
For your own good.
If you disable CORS the following can happen:
I send you link to a page called
hackfacebook.com for example. When you visit my page, I then request the facebook.com page using an AJAX request which if you are logged in returns the page content as well as your session cookie.
I now as the owner of
hackfacebook.com have your login session.
As you can see disabling CORS is at your own risk as it can open up another attack.
The purpose of CORS is to prevent a web browser that respects it from calling the server using non-standard requests with content served from a different location.
Standard requests are basically
- POST (but only certain types like
application/x-www-urlencoded, i.e. not
With just the limited set of standard headers. Anything outside those constraints will trigger a CORS check via an