CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers.
Can CORS Anywhere be used to bypass CSRF protection?
Reason to ask the question here:
Simple, for learning and also for breaking things and then applying a proper fix.
So I am testing my college's web site to make it more secure and after some time I noticed the application was preventing CSRF attacks by checking the
It doesn't check CSRF tokens. I can use other users CSRF tokens in same requests.
I tried changing
Content-Type:text/plain but it not worked. The response come as
Content-Type:text/plain not allowed.
I also tried changing the
GET but it did not work either.
Also this site doesn't have crossdomain.xml File. So flash based trick no chance.
Suggestions are highly appreciated.