I need some clarifications about the problems that CORS (Cross-Origin Resource Sharing) can cause. Let's suppose that site A.COM has enabled CORS, in particular:
- Access-Control-Allow-Origin can be set to any website in the HTTP request and it is copied back in the response
- Access-Control-Allow-Credentials can be set to true
Given that, let's suppose that in the following A.COM path:
A.COM/user.php?id=USER_ID is hosted the password of the user (unrealistic, but let's go ahead).
The possible attack scenario is:
A.COM/user.php?id=USER_IDgets the result and store somewhere (maybe with additional http request to another attacker page)
- Attacker needs to force the user to load B.COM
So, my question is:
As to access
A.COM/user.php?id=USER_ID an user must be authenticated and have cookie set, the attacker needs to be sure that the attacked user has valid cookie for A.COM and also the attacker needs to know the web structure of A.COM?
If the attacked user is not logged in and does not have any cookie set, the attack does not work?
Thank you for the clarifications.