About several years ago I found a website during a pentest which had the Access-Control-Allow-Origin header set to "*". I made a POC to get the response of a webpage from an untrusted domain. The goal was to get the CSRF token from the webpage, which was displayed for logged in users. So the HTTP request performed by the POC actually sent user's cookies.

The scenario was like this one:

  • User is logged on a.com
  • User loads POC from attack.com
  • The POC sends an HTTP request with user's cookies to a.com
  • The POC retrieves the CSRF token and perform actions on a.com

I'm pretty sure the POC sent user's cookies, that I did not use the withCredentials attribute, and the header Access-Control-Allow-Credentials was not present in the targeted website. I used Firefox at this time.

Nowadays, the header Access-Control-Allow-Credentials: true is required in order to allow the response to be available plus the Access-Control-Allow-Origin header should not be set to * if cookies are sent.

So my question is, since when this restriction was added ?

  • The oldest entry of Access-Control-Allow-Credentials I could find, was September 2008 in the [Access Control for Cross-Site Requests Working Draft][1] by W3C. However, it would be better to know what is the newest browser version for various browsers which do not implement the W3C draft from 2008. I too remember executing a similar PoC to yours several years ago. [1]: w3.org/TR/2008/WD-access-control-20080912/… – infosec May 11 '14 at 9:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.