5

MDN says that attempting to use Access-control-allow-origin: * with credentials should result in an error.

Taking this into account, why so many major companies' APIs (spotify, twilio, among many others) return both Access-control-allow-origin: * and Access-control-allow-credentials: true response headers?

Improve this question
3
  • 1
    You're right that the settings don't mix. Are you sure "many major companies" use that setup? Could it be that once the client actually sends the request withCredentials, the ACAO: * response disappears?
    – Arminius
    Commented Sep 15, 2019 at 17:45
  • Adding some fake cookies in request don't make the response any different. Are you suggesting that it might be a common pattern to return different access-control headers if valid credentials are passed? That could make sense, but doesn't really answer the question why they send it in the first place.
    – Bart Juriewicz
    Commented Sep 15, 2019 at 18:02
  • The idea would be to always answer ACAO: * to unauthenticated/malformed requests so that clients can easily read the response for debugging purposes, e.g. in case they accidentally supplied a bad origin. I can't back that theory up, though.
    – Arminius
    Commented Sep 15, 2019 at 18:22

1 Answer 1

Reset to default
3

Access-control-allow-origin: * and Access-control-allow-credentials: true

First and foremost let me tell you what those headers are.The Access-control-allow-origin is a response header sent by a website which tells the browser to relax the same origin policy for the website listed in it.The wildcard * means any origin(domain,subdomain) can send request and receive response.The access-control-allow-credentials is a response header which instructs the browser to send in cookies along with the request.

What would happen if Access-control-allow-origin: * and Access-control-allow-credentials: true is set?

An attacker could take you to a website and then that website could issue a request to another website with the configuration and read the response.This would pretty much wreak havoc on the internet.

Why website are allowed Access-control-allow-origin: * and Access-control-allow-credentials: true?

Browsers simply ignores it if Access-control-allow-origin is set to wildcard then the browser wont allow submitting of credentials(cookies) with the request which would render any attack useless since you can't target anyone without their cookies.

Then why do websites send this combination of response headers?

First and foremost for non credentials request, Secondly this could be due to the presence of changing of ACAO with the origin header. If no origin is specified then the response ACAO contains the wildcard. But I have nothing to back up this part of the answer

Improve this answer
3
  • 2
    Yeah, so why they add Access-control-allow-credentials: true header?
    – Bart Juriewicz
    Commented Sep 15, 2019 at 18:11
  • 1
    @BartJuriewicz to allow cross domain ajax requests.cypressnorth.com/programming/…
    – yeah_well
    Commented Sep 15, 2019 at 18:24
  • 2
    But you can't do a cross-origin request with credentials when there's ACAO: *
    – Bart Juriewicz
    Commented Sep 15, 2019 at 18:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .