Questions tagged [cors]

Cross Origin Resource Sharing (CORS) lets servers specify what origins can access resources through XHR by setting HTTP headers (e.g. Access-Control-Allow-Origin).

Filter by
Sorted by
Tagged with
0
votes
0answers
27 views

Security risks of leaving localhost in CORS [duplicate]

I'm developing a SPA that communicates with an API hosted on GAE. For development purposes, I want to be able to run both the SPA and API locally on localhost:8080 and localhost:8081 respectively. ...
0
votes
0answers
42 views

Why SetCookie's SameSite directive applies the destination rather than the origin?

I understand that the SameSite directive tries to protect against cross-origin leakages and CSRFs (see OWASP), but I don't get why (on my browser at least) it applies to the cookie's destination ...
0
votes
0answers
55 views

Do best practices eliminate the need for a CSRF token when writing an API server?

I realize that OWASP recommends CSRF tokens but I rarely see them used with public standalone HTTP APIs. This would seem to indicate that they're not always necessary. To make this a little more ...
1
vote
1answer
53 views

CORS misconfiguration

While testing a website for CORS misconfiguration, I have found that access-control-allow-origin header is being set dynamically based on host header in requests. Is it safe or can be exploited? ...
0
votes
0answers
63 views

CORS issue with WebApp on Azure + AAD

I would like to get some experts' advice regarding the way I resolved the following issue: Let's say my personal app is hosted as an Azure App Service on https://example.azurewebsites.net The JS ...
0
votes
0answers
60 views

Custom header to avoid CSRF attacks? header without token

I found that a website protects itself of CSRF attacks by validating the POST request contains a specific header: -Example-header: GF What i find strange is that this header doesn't have a csrf ...
0
votes
1answer
87 views

Clarification of relationship between CORS and CSRF [closed]

To summarize: CSRF is an attack where a page in a different window/tab of the browser sends nonconsensual request to an authenticated web app, that can typically be prevented from server-side by ...
0
votes
1answer
43 views

Bypassing header validation

I have made a script that can be used for exploiting CORS misconfiguration. The script works fine but if I want to send an extra header to the request by xhttp.setRequestHeader("test_header", "...
0
votes
1answer
40 views

Amazon S3 policies: CORS or Service Accounts?

I have a question about accessing buckets on AWS S3. Let's suppose we have a bucket that has to have public read access by everyone and only my API has to be able to PUT and DELETE items from bucket. ...
2
votes
1answer
325 views

CORS error but only from AJAX and not from HTML form

I study web attacks. I find that it is possible to submit a form with HTML from another origin into the victim server. But if I use AJAX then I get a CORS error. Is this the expected behavior? If yes, ...
1
vote
1answer
102 views

Can somebody explain why the IP address 192.168.1.1 is apparently “special” and not following the CORS rules?

I asked this question: What would happen if some random webpage made an Ajax request for http://127.0.0.1/private.txt? The answers/comments confuse me. Am I right in interpreting them like this? "...
0
votes
0answers
25 views

Enable CORS for multiple customers

We use .htaccess file for controlling access: Currently, we have the following code to allow CORS to our developer APIs: <If "%{REQUEST_URI} =~ m#^/api/v1/#"> Header always add ...
0
votes
1answer
64 views

Exploiting CORS and storing the response to server

I am trying to exploit misconfiguration CORS. I have created and hosted a file in HTML and Javascript where if someone clicks the link there HTTP response containing cookies will reflect them on the ...
3
votes
0answers
276 views

CORS Trusting Arbitrary Origin on Mobile App

I am testing a mobile app that makes calls to a REST API. The API is only used by Android and iOS apps. Apps are native apps and they do not use web views. API trusts arbitrary Origins and Access-...
0
votes
1answer
66 views

CORS vulnerability or secure?

Testing a website i am in this scenario, i found a CORS endpoint that allows any subdomains to access it, so for example: Real request: Origin: https://abc.realwebsite.com ---> access-control-...
1
vote
1answer
48 views

Block request serverside following CORS

Should non options requests be blocked if the origin header is not allowed? I was talking about programming to someone and which led me to tell them about CORS. The person compared it to a gate. ...
1
vote
2answers
73 views

Is it possible too exploit CORS with double Origin value?

I found a website that has a well implemented CORS configuration, but for some reason I am able to insert two Origin headers in a POST request, and both of these values are reflected in the reponse. ...
4
votes
1answer
162 views

What's the reason of both “Allow-Origin: *” and “Allow-Credentials: true” headers?

MDN says that attempting to use Access-control-allow-origin: * with credentials should result in an error. Taking this into account, why so many major companies' APIs (spotify, twilio, among many ...
0
votes
2answers
55 views

Scraping data from a form submission on another domain

I’m currently researching a possible security vulnerability I may have found on a well-known website. Before I present to the company, I’d like to build a proof of concept. I’m looking at a site (...
1
vote
2answers
766 views

CORS requests for Instagram fail without VPN

My wife's machine could not load any Instagram content through JavaScript because of the following error: Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at ...
0
votes
1answer
51 views

Does changing an image src attribute to call a PHP function on my server to retrieve an image from another server eliminate CORS policy issues?

I am working in React, and I have an image which has an src attribute of https://s3.amazonaws.com/sample_endpoint. My website domain is https://sample-website.com. I am using a library, dom-to-image, ...
1
vote
1answer
84 views

Why CORS is still securing an open api where all requests have a wildcard (*)?

In case of an open API, the only possible value for Access-Control-Allow-Origin is a wildcard (*), since you can't have a list of allowed domains. Still, this seems not to bug developpers and appears ...
0
votes
1answer
124 views

Why are web font resource requests not no-cors?

CSS, JS, images etc are all fetched as no-cors. What's different about web fonts? Per the spec: For font loads, user agents must use the potentially CORS-enabled fetch method defined by the [FETCH]...
1
vote
3answers
198 views

How to stop app from fetching data from my website?

I am running a website that contains data that our users can access if they login. Someone else has created an Android app that lets users access that data as well. They enter their credentials, and ...
2
votes
1answer
405 views

Exploitability of allowed wildcard (*) CORS Origins with Bearer Token Authorization [duplicate]

I'm looking at the following setup. A web application uses a REST API to communicate with the server. All API responses include Origin: *. For authorization Authorization: Bearer <token> is used....
0
votes
1answer
214 views

access-control-allow-headers: * is being ignored

Although the OPTIONS returns * for Allow-Headers I'm getting the following CORS response. Access to XMLHttpRequest at 'https://example1.com' from origin 'https://example2.net' has been blocked by ...
0
votes
1answer
74 views

How to authorize access to a resource when requested with CORS and validate the origin?

I'll try to make the explanation simple and to the point (keyword try). And if that's not sufficient, then maybe I can expand on the question. Imagine two sites: resources.example.com and www.example....
3
votes
0answers
104 views

Is it possible to exploit this cors?

I found an xss on subdomain.example.com and i verified that the domain api.example.com accepts subdomain.example.com as valid origin. Can i exploit this as cors by inserting a CORS script in subdomain....
1
vote
1answer
108 views

How can the Same Origin Policy protect the user in times of CORS headers?

How can the Same origin policy protect something if you can bypass it via Cross Origin Resource Sharing headers? And why are those assigned by the server which is tried to access and not by the user? ...
0
votes
1answer
80 views

Is this CORS exploitable?

So i was able to upload a html file on a server i'm allowed to test. The file is uploaded on a subdomain of the main server. Knowing that they allow CORS for anything.domain.com, is it possible to ...
1
vote
1answer
171 views

What's the purpose of the preflight check on CORS requests?

A fellow developer and I were experiencing a weird issue with our application in the past couple of days. Specifically, he's writing the API and I'm writing the web front end. Since the UI runs from ...
1
vote
2answers
74 views

CORS mis-configuration

I need to crate a PoC in order to exploit a CORS mis-configuration. I'have discovered that the vulnerable server implements a poor whitelist policy that checks if substrings are in the whitelist. So ...
1
vote
1answer
167 views

Is xhr.withCredentials making POST endpoints vulnerable to CSRF?

From what I've seen, someone can add the following code to a malicious site (lets say: http://sth.malicioussite.com) and be able to perform ajax post requests to a 3rd party site, along with any ...
1
vote
0answers
83 views

How x-permitted-cross-domain-policies is different from CORS(cross origin resource sharing)? [duplicate]

OWASP is recommending x-permitted-cross-domain header. I gone through many websites and blogs and didn't get to know the difference between x-permitted-cross-domain and CORS. Since I have implemented ...
0
votes
0answers
83 views

What's the attack vector for authenticated wildcard CORS origin for a public API?

I have a public API (intended to be used by third-party websites) authentication only via JWT bearer tokens (no cookie authentication). SPAs have to add the Authorization header for every API request....
5
votes
1answer
2k views

How to implement CSRF protection with a cross origin request (CORS)

tl;dr the Cookie-to-header-token method can't work due to the CSRF token cookie not being readable by the client in any way. Is sending the token in a header, and having the client save it in a cookie ...
1
vote
1answer
535 views

How can I securely disable CSRF validation for native clients when browser clients access the same API?

I have an API endpoint that is accessible by both native (console, mobile apps) and Javascript based clients. How do I ensure that the CSRF AntiForgeryToken is only invoked during Javascript calls? ...
0
votes
1answer
452 views

Do I correctly understand how CORS proxy works?

There are a lot of CORS proxy servers like this one: https://cors-anywhere.herokuapp.com/ This allows us to send requests from different origins. For example I can send request from my client's ...
1
vote
1answer
379 views

What scenario does CORS protect against?

My understanding of the same origin policy is that it prevents scripts from making requests to resources outside of the domain from which they originated. One motivation of this is to prevent a ...
4
votes
2answers
3k views

Why do browsers disallow accessing files from local file system even if the HTML document is also on the local file system?

Many browsers do not allow you to access files on the local filesystem with JavaScript (even if the HTML document is also on the local filesystem). (source) Yes I know that the solution is to "...
1
vote
0answers
36 views

Origin VS Authority and Domain certificates and Unique IPs

Disclaimer, I am new to InformationSecurity, so sorry if I not following rules as good as expected. I asked this post on stackOverflow, and I was suggested to transfer it here So far I get: Origin = ...
1
vote
1answer
308 views

CORS accepting arbitrary origin with GET but not with OPTIONS

I'm testing an API, which allows an arbitrary origin on POST/GET requests, by responding with the CORS header Access-Control-Allow-Origin: *. However, with OPTIONS requests and an arbitrary origin, ...
2
votes
1answer
4k views

Access-Control-Allow-Origin wildcard doesnt allow sending session cookies

I always thought CORS restrictions was to disable the following scenario: I enter attacker.com, JS sends GET facebook.com, my browser adds my cookies, attacker.com has access to my facebook profile/...
0
votes
1answer
575 views

How to steal cookie on website with cors?

When I make a cross origin request to example.com from anysite.com with req.withCredentials = "true"; cookies are included in the request The response contains access-control-allow-origin: https://...
0
votes
1answer
43 views

Is there any other way through which an attacker can obtain user data from HTTP response except MITM and CORS attack?

I am doing some research for my college project and I want to ask is there any other way through which an attacker can obtain data from HTTP response except MITM and CORS attack. For an example, If I ...
0
votes
1answer
75 views

Getting confusion that this responce indicate CORS vulnerability

HTTP/1.1 200 OK Content-Type: application/json Content-Length: 12 Connection: close Date: Tue, 25 Sep 2018 12:59:56 GMT x-amzn-RequestId: xxxxxxxxxxx Access-Control-Allow-Origin: * Access-Control-...
2
votes
1answer
928 views

Web-Application with CORS Origin: * using authorization header

As stated here, https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS at "Credentialed requests and wildcards". Quote: When responding to a credentialed request, the server must specify an ...
2
votes
2answers
2k views

XMLHttpRequest CSRF fails with allowed CORS

I'm currently working on a PoC for a CSRF attack, which should be possible due to the lax CORS configuration. I have a permission to attack. Now the following code should send a OPTIONS request, ...
0
votes
1answer
89 views

What party is protected by not turning on CORS?

Here's what I know about CORS: It allows you to access data on another domain from the frontend of any other website, as long as the access-control-allow-origin property is properly set on the machine ...
5
votes
1answer
1k views

CSRF Protection Is Needed for GET Requests

I have a REST API that allows authenticated users to read data about their own account and make changes to their accounts. For authentication I use JWTs stored as httpOnly cookies. To protect against ...