1

Should non options requests be blocked if the origin header is not allowed?

I was talking about programming to someone and which led me to tell them about CORS. The person compared it to a gate.

Which in turn led me to look at my code which adds the CORS headers but does not block if the origin is not allowed. Now I get that for options that this is not really doable because it is the check. However, for a POST request, for instance, if the origin is not allowed, should the request be blocked or is already too late at that point?

It is possible that a server does the request, so CORS does not apply at all and no origin is set so it cannot be done. So, this only truly applies to browsers (as far as I know). So, perhaps when this happens the browser is already so far gone that this is already too late.

2

CORS headers are only honored by supported User Agents (UA from now on). The responsibility of a web developer is to set the appropriate CORS headers for every response, and it will be the responsibility of the UA to enforce such headers and block the access if the headers are going to be violated.

Any request made by the UA will fall in only 1 of 2 categories regarding CORS:

  • Basic requests that don't require any special treatment
  • More complex requests that require some special treatment

The process that decides in what category a request ends up depends only on the http request (if it has a payload, the http method, cookies, other headers...) and is decided by the UA and written in the RFC.

If the original request requires some special treatment, then the UA will perform 1 more request before the original http request, that second request has an OPTIONS method to the same URI of the original http request and is only done to get the CORS headers that will apply to the original request in order to make the decision to allow or deny the original request.

Now regarding your questions:

However, for a POST request, for instance, if the origin is not allowed, should the request be blocked or is already too late at that point?

Since a POST requests is always a request that requires special treatment, it will get denied after the OPTIONS request (also called preflight request) is done if the CORS headers deny the request.

It is possible that a server does the request, so CORS does not apply at all and no origin is set so it cannot be done.

Yes, if a server is doing a CORS request, then it's his responsibility to honor it since it has become the UA of that http request.

So, this only truly applies to browsers (as far as I know).

Kind of correct, it applies to any UA that honors CORS headers, and that is usually a browser, but doesn't have to be per se.

So, perhaps when this happens the browser is already so far gone that this is already too late.

This can never happen for special treatment requests, since a browser that supports CORS will only make a request once the preflight request has allowed him to do so.

1
  • If I get your answer right it is no, it makes no sense to block – MKroeders Oct 24 '19 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.