Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [cors]

Cross Origin Resource Sharing (CORS) lets servers specify what origins can access resources through XHR by setting HTTP headers (e.g. Access-Control-Allow-Origin).

1
vote
2answers
65 views

Why do browsers disallow accessing files from local file system even if the HTML document is also on the local file system?

Many browsers do not allow you to access files on the local filesystem with JavaScript (even if the HTML document is also on the local filesystem). (source) Yes I know that the solution is to "...
1
vote
0answers
26 views

Origin VS Authority and Domain certificates and Unique IPs

Disclaimer, I am new to InformationSecurity, so sorry if I not following rules as good as expected. I asked this post on stackOverflow, and I was suggested to transfer it here So far I get: Origin = ...
1
vote
1answer
47 views

CORS accepting arbitrary origin with GET but not with OPTIONS

I'm testing an API, which allows an arbitrary origin on POST/GET requests, by responding with the CORS header Access-Control-Allow-Origin: *. However, with OPTIONS requests and an arbitrary origin, ...
0
votes
1answer
186 views

Access-Control-Allow-Origin wildcard doesnt allow sending session cookies

I always thought CORS restrictions was to disable the following scenario: I enter attacker.com, JS sends GET facebook.com, my browser adds my cookies, attacker.com has access to my facebook profile/...
0
votes
1answer
122 views

How to steal cookie on website with cors?

When I make a cross origin request to example.com from anysite.com with req.withCredentials = "true"; cookies are included in the request The response contains access-control-allow-origin: https://...
-1
votes
0answers
37 views

Cross Origin Resource Sharing null vs wildcard?

I am testing an application that uses widget. These widgets are placed in the customer websites to use as some sort of tracking clicks device and returns some data too, therefore it is necessary to ...
0
votes
1answer
26 views

Is there any other way through which an attacker can obtain user data from HTTP response except MITM and CORS attack?

I am doing some research for my college project and I want to ask is there any other way through which an attacker can obtain data from HTTP response except MITM and CORS attack. For an example, If I ...
0
votes
1answer
58 views

Getting confusion that this responce indicate CORS vulnerability

HTTP/1.1 200 OK Content-Type: application/json Content-Length: 12 Connection: close Date: Tue, 25 Sep 2018 12:59:56 GMT x-amzn-RequestId: xxxxxxxxxxx Access-Control-Allow-Origin: * Access-Control-...
1
vote
1answer
171 views

Web-Application with CORS Origin: * using authorization header

As stated here, https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS at "Credentialed requests and wildcards". Quote: When responding to a credentialed request, the server must specify an ...
2
votes
2answers
222 views

XMLHttpRequest CSRF fails with allowed CORS

I'm currently working on a PoC for a CSRF attack, which should be possible due to the lax CORS configuration. I have a permission to attack. Now the following code should send a OPTIONS request, ...
0
votes
1answer
60 views

What party is protected by not turning on CORS?

Here's what I know about CORS: It allows you to access data on another domain from the frontend of any other website, as long as the access-control-allow-origin property is properly set on the machine ...
2
votes
1answer
290 views

CSRF Protection Is Needed for GET Requests

I have a REST API that allows authenticated users to read data about their own account and make changes to their accounts. For authentication I use JWTs stored as httpOnly cookies. To protect against ...
2
votes
1answer
482 views

How do CORS proxy websites work?

While I was developing the front-end side of my web project, I got an CORS protection error. Not surprising since my front-end project was not in the same origin. After some search on how to bypass ...
1
vote
1answer
151 views

Is it possible to send cookies from third party server to browser using CORS

UPDATED FROM THE LAST QUESTION WITH MORE DETAILS I'm building a full javascript app from Salesforce.com API with no server side script that will be hosted on salesforce.com domain (https) This app ...
0
votes
1answer
363 views

XMLHttpRequest with preflighted CORS missing authorization token

I have a followup question to this older question: How to exploit a misconfigured CORS policy when a per user authorization token is required? According to the documentation here, the Access-Control-...
2
votes
1answer
209 views

Why is the same origin policy sensible - for requests?

This is not the same question as Why is the same origin policy so important?. That one asks only about why cookies are only ever send to origin they came from, which I understand. What I don't ...
0
votes
0answers
152 views

CORS returning two Access-Control-Allow-Origin headers?

I am doing a verification test for a CORS issue that we discovered. When specifying an origin, the application used to respond with the allow origin to any URL. However, upon retest, the application ...
2
votes
1answer
69 views

When implementing CORS, should I check for a correct HOST header in my webapp?

I have a backend web server that serves an API (over HTTPS) to a frontend browser client on a different subdomain. It uses CORS to allow this. The CORS spec directs you to not send the CORS headers ...
0
votes
2answers
331 views

is every site without a CSRF token vulnerable to CSRF attack?

I found a lot of popular sites not having crsf token in cookie header, does that mean all of these sites are vulnerable? I tried to learn more about it and found there's something called CORS which ...
3
votes
0answers
48 views

What are the design considerations behind exempting WebSockets from the SOP?

I was rather surprised that in my experiments, I could simply connect from one website to a WebSocket server on a different domain/port pair. Subsequent research repeatedly showed that WebSockets do ...
1
vote
0answers
37 views

Why doesn't a CORS preflight request cause another?

According to MDN documentation, every non-simple request is doomed to fall into an infinite recursion: I want to send a non-simple CORS request (with the verb PUT e.g.) My browser tries to send a ...
2
votes
1answer
331 views

Why CORS preflight is not available for POST requests when Content-Type is application/x-www-form-urlencoded

In oauth2 for single page application(SPA), we can revoke the access tokens of the implicit grant type by using an ajax request(this is not recommended now). I tried to do a request like below from ...
5
votes
1answer
290 views

Is it secure to use CORS to implement SSO?

I implement SSO to integrate some web login mechanism to the centralized member system which is OAuth2 provider. And currently OAuth2 authorization works well. However, I would like to implement much ...
0
votes
1answer
392 views

Is CORS and CSRF-tokens only for POST and GET requests? [closed]

I have the following questions regarding CSRF, SOP and CORS. Does CSRF tokens only protect form submission with either POST or GET methods? Is this just a "common practice" (regarding the fact that ...
1
vote
2answers
341 views

CORS Exploitation and POC [closed]

How do I exploit an application returning headers as the following Access-Control-Allow-Origin: * What exact information do we get if the following is set to * To make it concise, If an application ...
3
votes
1answer
586 views

BeEF XSS - internal working

I am studying BeEf XSS as I think it is a very interesting tool for a penetration tester, but I have a couple of doubts about it, in particular when linking it to Cross Domain Request. So, in some ...
2
votes
2answers
78 views

Why return successfully to non-allowed origins

As I understand it, with CORS, on cross-origin requests, the browser will send an Origin header, and if the origin isn't allowed, the server will still send back a 200 response with a non-matching ...
0
votes
1answer
239 views

Preventing CSRF/XSS on mobile/web shared API

I have inherited a code-base that includes a mobile & web app that both access the same API and have been tasked with fixing some of the security holes that exist, unfortunately I am not well-...
1
vote
2answers
85 views

CORS clarification

I need some clarifications about the problems that CORS (Cross-Origin Resource Sharing) can cause. Let's suppose that site A.COM has enabled CORS, in particular: Access-Control-Allow-Origin can be ...
0
votes
1answer
117 views

Securely embedding a widget submitting forms to our servers on third party websites?

I would like to build a javascript widget that third party developers inject on their page by adding: <script type="text/javascript" src="https://test.com/widget.js" async></script> The ...
4
votes
0answers
3k views

Configure Access-Control-Allow-Origin for clients with origin: null

I develop a web app. When I run the app on Android, origin in the header of a network request is null. Access-Control-Allow-Origin in the response header is null too, because the origin of the ...
5
votes
1answer
154 views

Are restrictive same origin policies necessary?

The question is for the security community to resolve some misunderstandings here. The crux: Company (Wire) has a client (official-client.com) and a server code (e.g. official-server.com ). CORS ...
9
votes
1answer
539 views

Why is a “tainted canvas” a risk?

I understand the concern about a tainted canvas - the idea that the bits of an image from another site can be sent back to a malicious server. But can you explain the details of how exactly this works?...
1
vote
2answers
593 views

CSRF with a CORS JSON API [duplicate]

We have api.example.com that communicates with app.example.com, a native Android app and an iOS app. We want to allow other third parties to communicate with the API too if they want, and as such we ...
0
votes
1answer
38 views

Can Origin headers be sent with get variables or the whole url?

An application I'm working on responds to a wildcard Origin header by setting the Access-Control-Allow-Origin to subdomain.app.com if ending with .app.com. However, if I append .app.com to a GET ...
0
votes
1answer
4k views

Check for insecure CORS settings with cURL

I'm trying to verify the CORS settings of a website using cURL. The following command should let me check whether the CORS settings can be considered as secure or if requests may be made across ...
1
vote
1answer
1k views

How to verify CORS policy implementation?

We've added Access-Control-Allow-Origin: *.domain.com and I'm able to view this in the response header. But how can I make sure this is implemented in the right way. When I modify Origin or Referer ...
6
votes
2answers
1k views

How does setting Origin to null in a redirected CORS request protect against a confused deputy attack?

Excerpt from Here: If a cross-origin resource redirects to another resource at a new origin, the browser will set the value of the Origin header to null after redirecting. This prevents additional ...
0
votes
0answers
89 views

Does SOP helps against CSRF attacks? [duplicate]

I guess my true questions is why do you need csrf token and SOP (strict CORS policy isn't enough). CSRF: when evil.com makes request to bank.com/logout If evil.com does it through XHR, then browser ...
2
votes
2answers
2k views

Is it safe to set “Access Control Allow Origin” header's value to the “Origin” header's value which is implicitly set by the browser?

I was testing a website and noticed that changing the "Origin" Header's value of a request with an intercepting proxy application results in the web application sending a response with "Access Control ...
2
votes
2answers
638 views

HTTP access control (CORS) purpose

As there is an option to disable HTTP access control (CORS) in browsers, so I can send requests to any origin. So why should I bother to run a Browser with CORS enabled?
2
votes
1answer
377 views

Why do we use CORS?

I am confused about why websites use CORS. I know CORS provide some protocols through which website can call the resources from other domains, but is it possible to call the resource without CORS? If ...
3
votes
2answers
896 views

custom Origin header to bypass CORS protection against CSRF

CORS (cross-origin ressource sharing) can be used to protect webapps from CSRF, before accepting a request, the server verifies that the host specified in the Origin header is among the hosts allowed ...
1
vote
2answers
1k views

Is a single page application naturally breaking the same-origin policy?

Assume that you have a web application. The backend API is deployed at api.example.com and your frontend SPA is deployed at frontend.example.com. When you open it you download all the resources to ...
0
votes
0answers
2k views

CORS: What is the most secure set up for mobile app talking to backend API?

I'm currently building a mobile app which is talking to a backend API. Additionally I have a webapp with a seperate server also accessing the backend API. Authorization happens via a JWT token passed ...
0
votes
1answer
473 views

Crossdomain.xml - write access to domain

Is a permissive crossdomain.xml Flash policy analogous to a permissive CORS policy? i.e. Is <cross-domain-policy> <allow-access-from domain="*" /> </cross-domain-policy> the ...
1
vote
3answers
582 views

CSRF not working over CORS proxy

I'm consuming OData services from JQuery and running into a typical scenario of Same Origin Policy. I do not have control over the server and therefore I can not implement CORS so the only thing I can ...
1
vote
1answer
3k views

Ways to bypass browsers CORS Policy

I was pentesting a Json Rest API today; the API needs a specific header to be sent:- Content-Type: application/json which doesn't allow CSRF attacks. The only option I was left with was sending ...
2
votes
2answers
149 views

Why http cookies are automatically sent to the server upon a http requests and CSRF

On the client side, a http request sent from webpage A that targets website B will cause all cookies belonging to Website B to be sent to B (even when A does not belong to B). I do not understand ...
0
votes
2answers
418 views

Setting Access-Control-Allow-Origin: * when session identifiers are injected in the HTTP headers

Is it considered as secure for an application to set a header access-control-allow-origin: * if during the normal usage of the application, the client credentials are injected in the headers by the JS ...