2

We've added Access-Control-Allow-Origin: *.domain.com and I'm able to view this in the response header. But how can I make sure this is implemented in the right way.

When I modify Origin or Referer I still get response for the request.

1
  • 2
    press [F12], goto "Console", try something like fetch('//my.site').then(alert). if nothing happens, you're ok. if you see a "Javascript message", it's not working.
    – dandavis
    Commented Nov 10, 2017 at 8:07

2 Answers 2

2

Cors only works for ajax requests, not direct http requests. Before the GET request is issued in an ajax request, an OPTIONS request is issued to determine if it is from a valid domain. If it violates the CORS policy, the GET request is never issued. This doesn’t happen if you just issue a direct get request. A good way to test is to write some javascript that fires off an ajax request and deploy it to a server that is on a different domain. Visit that domain, and see if the call succeeds. With the header that you listed above, it won’t.

0

No need to test your CORS policy to tell you that it's misconfigured, in this case: *.domain.com is simply not a valid value for Access-Control-Allow-Origin. No conformant browser will allow any CORS request (from any origin) through, because the preflight request will just fail.

The values that the Access-Control-Allow-Origin can take are limited to

  • null,
  • the wildcard (*),
  • a single origin (e.g. https://example.org).

If you want to support all subdomains of a given domain, you need to dynamically validate the value of the Origin request header and reflect it in the Access-Control-Allow-Origin response header on the server side. For instance, if you received a request with

Origin: https://foo.example.com

your server should check that the header value is indeed an allowed origin and then reply with the following header (among others):

Access-Control-Allow-Origin: https://foo.example.com

CORS's lack of support for partial wildcards (e.g. https://*.example.org) has been described as a design mistake by some security researchers, such as

but I'm not aware of any signs that the CORS spec will evolve in that direction.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .