Is it possible to send a custom POST CORS request with json data?

I found that the website example.com is vulnerable to CORS and it's accepting my origin header:


, however the request is a POST one and if i try without any post data i get: {"errorCode":"invalid","message":"Invalid json body","statusCode":400}

I was wondering if it's possible to send cors requests containing json data. If it's possible how should i edit my proof of concept code?

At the moment i'm using the following:

var createCORSRequest = function(method, url) {
  var xhr = new XMLHttpRequest();
  if ("withCredentials" in xhr) {
    // Most browsers.
    xhr.open(method, url, true);
  } else if (typeof XDomainRequest != "undefined") {
    // IE8 & IE9
    xhr = new XDomainRequest();
    xhr.open(method, url);
  } else {
    // CORS not supported.
    xhr = null;
  return xhr;

var url = 'https://example.com/api/v1/post';
var method = 'POST';
var xhr = createCORSRequest(method, url);

xhr.onload = function() {
  // Success code goes here.

xhr.onerror = function() {
  // Error code goes here.

xhr.withCredentials = true;

But i'll need to add {"id":"test","name":"test"} as POST json data to my PoC to make it work. How could i do that?

New contributor
dinesh kumaar is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • 1
    While relevant, CORS is a feature, not a vulnerability. Do you mean CSRF? However, the answer to "how to add post data to XHR" is easily searched and off topic. While it may be possible to post it, you will have trouble sending the Content-Type header if required due to CORS preflight requests. – multithr3at3d Jun 29 at 21:14
  • @multithr3at3d, I found this website with a misconfigured CORS. Is currently accepting pre-flight requests from any other website, so i was trying to see if i could extract some of my data from it. It doesn't require the content-type header but the request is a POST type and should contain some json formatted data in order to work. So how can i send the missing json data via XHR (possibly editing the example code i posted up here? – dinesh kumaar Jun 29 at 21:20
  • For me this questions looks unrelated to security since it is basically asking how to do XHR POST with a json body. This is not a security question but a plain programming question. See for example Javascript : Send JSON Object with Ajax?. – Steffen Ullrich Jun 29 at 21:25

Your Answer

dinesh kumaar is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.