I have a follow-up question to this older question: How to exploit a misconfigured CORS policy when a per user authorization token is required?
According to Mozilla's documentation, the Access-Control-Allow-Credentials should be able to transport tokens such as Authorization headers because "Credentials are cookies, authorization headers or TLS client certificates."
However, when I attempt the following exploit, I can't seem to get any browsers to forward the token.
I'm attempting to perform the following cross domain request from https://my.domain/
:
var req = new XMLHttpRequest();
req.onload = reqListener;
req.open('GET','https://api.external.domain/',true);
req.withCredentials = "true";
req.setRequestHeader('authorization','');
req.setRequestHeader('cache-control','no-cache');
req.setRequestHeader('content-type','application/json');
req.send('{}');
function reqListener()
{
alert(this.responseText);
};
The request is preflighted (OPTIONS method) and the API responds with:
HTTP/1.1 200 OK
Access-Control-Expose-Headers: APIm-Debug-Trans-Id, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-Global-Transaction-ID
Access-Control-Allow-Headers: authorization,cache-control,content-type,pragma
Access-Control-Allow-Methods: GET
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://my.domain/
So far so good. Now the browser immediately follows up with a GET request but for this request to succeed I need it to include the header:
Authorization: bearer [redacted]
But the client's browser apparently can't access this token (?) even though I am authenticated to the API. Is there any way to grab this token from somewhere? I can't seem to find it in the browser's local storage and it's not a cookie value either.