I always thought CORS restrictions was to disable the following scenario:
I enter attacker.com, JS sends GET facebook.com, my browser adds my cookies, attacker.com has access to my facebook profile/feed.
BUT
I am trying to send a GET request from my http://shop.domain.com to MY http://www.domain.com/api/accounts/me with javascript, because I want to share some user information to my shop. shop.domain.com is shopify so I can't put any backend code to this subdomain.
I got this error:
Access to XMLHttpRequest at 'https://www.domain.com/api/accounts/me' from origin 'https://shop.domain.com' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.
my API returns Access-Control-Allow-Origin: *
and I STILL cannot post credentials. so what is the use case for Access-Control-Allow-Origin: *
? I can understand why it's not working but What am I protected from if this header is not present.
What change does this header bring at all?
also my cookies are domain-wide but HTTP only, so JS on the shop.domain.com cannot just extract my session id.