Questions tagged [cors]

Cross Origin Resource Sharing (CORS) lets servers specify what origins can access resources through XHR by setting HTTP headers (e.g. Access-Control-Allow-Origin).

Filter by
Sorted by
Tagged with
0
votes
1answer
36 views

Difference between `Access-Control-Allow-Origin: *` (wildcard) and specific origins

I have a mostly public API with some parts of it "credentialed" behind cookies, similarly to e.g. how WordPress' REST API works. (In our case, it's a GraphQL API but that shouldn't matter.) ...
0
votes
0answers
31 views

Block Cross-Origin requests for Youtube embedded video (with js api)

I am developing webpage in which I am embedding some Youtube video's. On my localhost environment I get the following errors: "Cross-Origin Request Blocked: The Same Origin Policy disallows ...
0
votes
0answers
36 views

How risky it is if a server allows client Javascript access to say an access token in header?

After authenticated by Google, a client browser attaches the idToken from Google to an application API server. Assuming google-auth-library auto-refresh an expired token, it now needs to send it back ...
2
votes
1answer
77 views

CORS configuration for service with single browser client

Please note: although I mention Spring Boot (and by proxy, Java) I believe this is a pure HTTP/web development question at heart, and as such, can be answered by anyone with CORS-configuration ...
0
votes
1answer
49 views

CORS with access-control-allow-credentials

Am I correct in assuming that setting the 'access-control-allow-credentials True' header, even if you are not including the 'access-control-allow-origin' header is potentially dangerous for a website? ...
0
votes
0answers
52 views

Should I strip the “Origin” header from client requests?

I'm trying to setup an nginx reverse proxy to a web product I can't modify (it's an appliance). Client --> https://myapp.com --> nginx --> https://10.1.5.9 I managed to do so, but it ...
0
votes
1answer
59 views

Is there an issue if application responds with access control allow origin * but there is no allow credentials header?

Since application is not responding with allow credentials header, an attacker can't craft cross domain request with cookies, but I was wondering if allow origin * alone (Without credentials being ...
3
votes
1answer
174 views

Does CORS interact with WebAssembly the same way it does with Javascript?

Anyone in the WebAppSec world is familiar with CORS as a mechanism to specify policy for when javascript is allowed to make API calls to different domains. As WebAssembly ("Wasm" - a binary ...
1
vote
2answers
63 views

Cookie-to-Header CSRF protection vs CORS

What advantages does a Cookie-to-header technique give over CORS in a cross-origin request scenario? Example scenario: A rest API called api.com provides data to good.com. api.com has allowlisted ...
0
votes
0answers
32 views

Is it possible for origin header to have alphaebtical port or parameters in real life scenario?

I'm testing this application which is properly validating origin header on the sever side. However, if I add any domain and the expect domain as port, application still consider this valid. Origin: ...
0
votes
0answers
31 views

What consequences has Access-Control-Allow-Origin: domain?

A web server is sending these headers as a response: Access-Control-Allow-Origin: domain Access-Control-Allow-Credentials: true I think domain is a mistake. What are the consequences? I can just ...
27
votes
7answers
9k views

How do hackers trick frontend validation?

I've always read: Put validations in the backend. Frontend validations are for UX, not security. This is because bad actors can trick frontend validation. But I'm having a hard time wrapping my head ...
0
votes
0answers
42 views

A potentially simpler same origin policy? [duplicate]

I know there are lots of posts on the same origin policy, but I specifically want to understand why it can't be done in this simpler way. If evil.com makes sends a request to bank.com, browsers will ...
0
votes
0answers
56 views

making CORS request to 3rd party API

I am modifying a javascript application running on an apache web server. This runs on a windows server inside of our corporate network which I am referring to as "local server" in the ...
0
votes
1answer
78 views

Permissive CORS - Arbitrary Origin Trust, Remedial Action?

I was completing an assessment for a client and discovered that web application implemented a Permissive CORS policy which allowed for a Arbitrary Origin Trust. Request: Host: [REDACTED] User-agent: ...
1
vote
1answer
64 views

Is server side CORS protection enough to mitigate CSRF attacks against stateless APIs?

Assume an Angular SPA application on www.example.com that works invoking an API over that same domain www.example.com/api/... The Angular app gets a session cookie and sends it in each API call. The ...
0
votes
1answer
122 views

Are there security issues around controlled cross site sharing behind SSO?

Very simply we have a ton of websites at our company behind SSO. I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get ...
0
votes
1answer
52 views

Protecting an external authentication server against CSRF

I have a web application which uses an external authentication server for obtaining a session. When a client tries to login, the browser is making requests towards the external authentication server ...
0
votes
0answers
26 views

How can the CSRF happen if browsers do not allow cross-origin requests by default? [duplicate]

How can the CSRF happen if browsers do not allow cross-origin requests by default? Brief CSRF overview, which is relevant for the question. CSRF is a type of attack (i.e. cross-site request forgery). ...
0
votes
1answer
56 views

Is it safe to add “Access-Control-Allow-Origin:*” to an API endpoint with custom authentication via header?

Lets say I have a site at myapp.com that talks to the api at myapi.com. For that to work I have to turn on CORS. I want to do it like that: Access-Control-Allow-Origin: * and my API authentication is ...
0
votes
0answers
31 views

Secure authentication for sites which allow user to modify js/html

We have a site builder, allows users to add/modify JS/HTML/CSS. Is it possible to provide a global authentication for it? I mean users login once but can interact with all sites as their own names. ...
1
vote
0answers
122 views

What is meaning of setting port number to NULL in document.domain call?

Here (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) it is mentioned The port number is checked separately by the browser. Any call to document.domain, including document....
1
vote
0answers
111 views

Vulnerability Reporting from “random” dude

A few days ago I got an email to our dpo email address from a person I don't know who claims to be a Security Researcher. The email is well written and contains a POC with screenshots of a CORS ...
0
votes
0answers
152 views

CSRF token not sent when calling the back-end?

My system composes of NuxtJs and AdonisJs application. Adonis handles csrf tokens for us by sending: set-cookie: adonis-session=XXX; Path=/; HttpOnly set-cookie: XSRF-TOKEN=XXX; Max-Age=7200; Path=/; ...
2
votes
2answers
442 views

Can we use CORS policy to restrict API calls from native mobile app?

We can use CORS to restrict API calls to a specific host in a web app. How to do the same for native mobile app? I want to restrict API calls from my app alone. Is it possible to do so?
1
vote
0answers
60 views

Allowing 3rd-party cookies in major 2020 browsers [closed]

I'm trying to get 3rd party cookies to work on major mid-year 2020 browsers [1]. It's as simple as pointing an iframe to an external URL to make a cookied request and probably get the response ...
0
votes
0answers
107 views

CORS response received in burp but not in browser console

NOTE: I am authorized to test this I was able to find a CORS vulnerability while intercepting it with burp, but cannot exploit it using browser. The request I sent in burp was: POST /xy/ HTTP/1.1 ...
1
vote
2answers
276 views

Cross-Domain Request is a CSRF Attack? (CORS)

CORS is a HTTP Suite header that “relax” the SOP. One of the CORS misconfigurations is about to reflect without reg exp the “Origin” client header into “ACAO” response header. If it happens with “ACAC:...
2
votes
1answer
76 views

Stuck in a tricky situation, not able to exploit misconfigured CORS

I found that this application has not properly configured CORS, an attacker can send requests from any origin and allow credentials header is also true. The idea was to extract CSRF token and then ...
1
vote
1answer
502 views

What is the connection between CORS and SameSite cookie attribute?

For most of them may be its a silly question but I want it to know this in very simple language. If an application is not using CORS at all then should we put this SameSite cookie attribute? and if ...
0
votes
1answer
244 views

Prevent Cross-site WebSocket hijacking with a custom header and no CORS

Considering I am vulnerable to Cross-site WebSocket hijacking, so my WebSocket handshake (GET to example.com/wss) does not require a random (CSRF) token. I have defined no CORS settings, so no custom ...
-1
votes
1answer
55 views

What is CORS default policy

What is CORS default policy if it's not explicitly implemented by the Web Server ?
2
votes
2answers
329 views

Can cross origin iframe be detected in web logs

A recent blog post shows hackers owning a web server - at least the content and injecting a web skimming attack. https://blog.malwarebytes.com/hacking-2/2020/03/criminals-hack-tupperware-website-with-...
2
votes
0answers
60 views

Concrete example of how can Access-Control-Allow-Origin:* cause security risks?

I have done some research but have not found an absolute answer to my specific question. I understand the basic concept of how this header will allow or disallow website A from sending request and ...
0
votes
0answers
45 views

CORS policy during development

Does the CORS policy add any value during the development phase? Should I develop with CORS on or off? The development is occurring in a distributed environment and there are no local copies of ...
0
votes
0answers
67 views

How to secure API used by third-parties?

What I am building is service that can be consumed by third-party. Something like Omdb API for example. For my service to be functional I needed to disable CSRF on some endpoints. How can I secure ...
3
votes
1answer
216 views

Is CSRF protection required for sensitive GET requests with CORS enabled?

Based on other questions, it seems protecting GET resources with CSRF tokens is useless. However, that quickly becomes untrue when CORS gets thrown into the mix I have a server domain server.com and ...
1
vote
2answers
139 views

With the existance of CORS, what further purpose does same origin policy serve?

I've been using CORS for a while and I think I understand it. But as far as I can tell, because the allow-origin header is provided by the server being called, which an attacker can control as they ...
0
votes
0answers
158 views

Do best practices eliminate the need for a CSRF token when writing an API server?

I realize that OWASP recommends CSRF tokens but I rarely see them used with public standalone HTTP APIs. This would seem to indicate that they're not always necessary. To make this a little more ...
1
vote
1answer
71 views

CORS misconfiguration

While testing a website for CORS misconfiguration, I have found that access-control-allow-origin header is being set dynamically based on host header in requests. Is it safe or can be exploited? ...
0
votes
0answers
238 views

Custom header to avoid CSRF attacks? header without token

I found that a website protects itself of CSRF attacks by validating the POST request contains a specific header: -Example-header: GF What i find strange is that this header doesn't have a csrf ...
0
votes
1answer
124 views

Clarification of relationship between CORS and CSRF [closed]

To summarize: CSRF is an attack where a page in a different window/tab of the browser sends nonconsensual request to an authenticated web app, that can typically be prevented from server-side by ...
0
votes
1answer
89 views

Bypassing header validation

I have made a script that can be used for exploiting CORS misconfiguration. The script works fine but if I want to send an extra header to the request by xhttp.setRequestHeader("test_header", "...
1
vote
1answer
81 views

Amazon S3 policies: CORS or Service Accounts?

I have a question about accessing buckets on AWS S3. Let's suppose we have a bucket that has to have public read access by everyone and only my API has to be able to PUT and DELETE items from bucket. ...
5
votes
1answer
958 views

CORS error but only from AJAX and not from HTML form

I study web attacks. I find that it is possible to submit a form with HTML from another origin into the victim server. But if I use AJAX then I get a CORS error. Is this the expected behavior? If yes, ...
1
vote
1answer
124 views

Can somebody explain why the IP address 192.168.1.1 is apparently “special” and not following the CORS rules?

I asked this question: What would happen if some random webpage made an Ajax request for http://127.0.0.1/private.txt? The answers/comments confuse me. Am I right in interpreting them like this? "...
0
votes
0answers
29 views

Enable CORS for multiple customers

We use .htaccess file for controlling access: Currently, we have the following code to allow CORS to our developer APIs: <If "%{REQUEST_URI} =~ m#^/api/v1/#"> Header always add ...
0
votes
1answer
117 views

Exploiting CORS and storing the response to server

I am trying to exploit misconfiguration CORS. I have created and hosted a file in HTML and Javascript where if someone clicks the link there HTTP response containing cookies will reflect them on the ...
3
votes
0answers
2k views

CORS Trusting Arbitrary Origin on Mobile App

I am testing a mobile app that makes calls to a REST API. The API is only used by Android and iOS apps. Apps are native apps and they do not use web views. API trusts arbitrary Origins and Access-...
0
votes
1answer
102 views

CORS vulnerability or secure?

Testing a website i am in this scenario, i found a CORS endpoint that allows any subdomains to access it, so for example: Real request: Origin: https://abc.realwebsite.com ---> access-control-...