Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more

Questions tagged [cors]

Cross Origin Resource Sharing (CORS) lets servers specify what origins can access resources through XHR by setting HTTP headers (e.g. Access-Control-Allow-Origin).

Filter by
Sorted by
Tagged with
5 votes
1 answer
873 views

What are the reasons for CORS failure errors to not be available to JS?

From Cross-Origin Resource Sharing (CORS) - HTTP | MDN: CORS failures result in errors but for security reasons, specifics about the error are not available to JavaScript. All the code knows is that ...
Ooker's user avatar
  • 1,591
1 vote
0 answers
58 views

Risks with having a "localhost" service configured on a production SAML/OAuth/OIDC Identity Provider

To help developers with integrating with our SAML/OAuth/OIDC Identity Provider on their local dev environments, I'm thinking about configuring a demo client/app in our production IdP that has ...
xsrf's user avatar
  • 178
1 vote
1 answer
347 views

Is prohibiting cookies a viable CORS alternative?

I have been using lots of various APIs in my frontend lately and they all have to be properly configured with CORS and the browser always do extra OPTIONS request that only make debugging harder. I ...
Ilya Chernomordik's user avatar
4 votes
2 answers
1k views

Do browsers have a defence against CORS from internet to intranet sites?

I was testing an internal application recently, that had fully permissive CORS, i.e. it echoes the Origin header into Access-Control-Allow-Origin, has Access-Control-Allow-Credentials: true and ...
paj28's user avatar
  • 33.4k
0 votes
1 answer
122 views

Certificate structure for accessing a local device from a web app

I have a pretty standard web app (react client, node server), https-enabled. I want to add the ability for the web app to access a device on the local LAN. The device has REST APIs and I can install ...
Jim B.'s user avatar
  • 101
4 votes
1 answer
1k views

Why is the browser not sending cookies with cross-domain WebSocket handshake request?

If I have understood Cross-Site WebSocket Hijacking (CSWSH) attack correctly [1][2][3][4], the attack relies on two things (examples are from the first reference): the browser sending the cookies set ...
sherlock's user avatar
  • 569
0 votes
1 answer
787 views

"CORS Error" but Chrome sent the request anyway

I have created a page to attack a CSRF unprotected endpoint. This endpoint accepts only JSON as payload, so I have used fetch with credentials: "include" properties. The page run locally ...
A.DUPONCHEL's user avatar
1 vote
1 answer
524 views

Are CORS headers useless?

It is common to say that CORS headers protect against CSRF, so that if you visit a malicious website, it cannot make a request to your web application because the referer header (the URL of the ...
Vitor Figueredo Marques's user avatar
0 votes
1 answer
2k views

Does CORS Access-Control-Allow-Credentials apply to non-origin/third-party cookies or as well?

I understand if you are cross-communicating with origin A, then if origin A has no Access-Control-Allow-Credentials in the response, you will never be able to reuse Cookies obtained from origin A ...
Whimusical's user avatar
1 vote
2 answers
200 views

Are timing-based side-channel attacks against the server during CORS preflight a legitimate concern?

Section 3.2.3 of the Fetch standard provides some guidance about how servers can/should handle preflight requests. A successful HTTP response, i.e., one where the server developer intends to share it,...
jub0bs's user avatar
  • 403
1 vote
0 answers
114 views

Storing auth token in html

Current projects webs application utilises a cookie based approach to store users auth token. Implemented with secure and http-only attributes set. All traffic over https. The application loads third ...
Sam's user avatar
  • 11
2 votes
1 answer
990 views

Is it possible to steal a cookie without HttpOnly via CSRF?

Without giving too many details away, let's say that I'm auditing an API that: Has access-control-allow-credentials: true Has access-control-allow-origin: * Needs JWT set in Authorization header for ...
JulianGR's user avatar
2 votes
0 answers
96 views

Auth Token not included in CORS exploit [closed]

I have found a CORS on a website but when I am trying to exploit it for a POC it is fetching all the cookies except auth cookies and due to that I am getting an error message to "User not logged ...
Abhinav Kumar's user avatar
0 votes
1 answer
592 views

WP-JSON: Cross Origin Resource Sharing Vulnerability?

I am testing the security of a webpage owned by the company I work for. I noticed that an arbitrary origin is accepted. In the screenshot below, you'll see that I added that example origin which was ...
UbuntuNoob's user avatar
1 vote
2 answers
956 views

Is my understanding of CSRF, SOP and CORS correct (Express / React)?

I am a hobby developer and am developing an application with a Node JS / Express backend and a React frontend. I am currently learning about Cross Site Request Forgery (CSRF), and I want to make sure ...
David's user avatar
  • 11
1 vote
1 answer
376 views

CORS bypass by adding the attacker domain beside the target's domain

When I add a second origin header it is added to the Access-Control-Allow-Origin response header but it adds it with the main domain. Example: I intercept the request in burp suite and add this: ...
Ali Saleh's user avatar
2 votes
2 answers
2k views

String in JSON message body blocked by Azure WAF with OWASP 3.1 returning 403

Details I have an application running behind an Azure Web Application Firewall (WAF) on an Azure Application Gateway (AppGW) that was previously on an on-premises server. Since moving it to Azure, ...
FilBot3's user avatar
  • 123
1 vote
2 answers
1k views

Is CSRF token vulnerable if CORS is enabled?

Let's analyze the following scenario: User authenticates with session cookie I have CORS enabled (like Access-Control-Allow-Origin: * - header) I use CSRF Token to prevent CSRF attacks and I include ...
Qback's user avatar
  • 113
8 votes
2 answers
2k views

Security Headers: Access-Control-Allow-Origin vs. Cross-Origin-Resource-Policy (CORP)

Can someone explain the difference between the Access-Control-Allow-Origin header and the Cross-Origin-Resource-Policy header? According to MDN: The Access-Control-Allow-Origin response header ...
hubu's user avatar
  • 81
-1 votes
1 answer
1k views

CORS attack using authentication token [closed]

I found a website which is vulnerable to cors.(https://portswigger.net/web-security/cors) GET /api/requestApiKey HTTP/1.1. Host: vulnerable-website.com. Origin: https://evil.com. AUTHENTICATION: ...
Cyber World's user avatar
0 votes
1 answer
628 views

Why is Content Security Policy necessary given Same Origin Policy?

Given that Same Origin Policy prevents JavaScript from one origin from running in another origin and accessing another origin's cookies, why is CSP necessary? Is it that CORS selectively removes some ...
Prime's user avatar
  • 514
1 vote
1 answer
3k views

CORS request is not sending Authorization: Bearer <value> header

When loggin in to a website, A Bearer token is generated and echoed back from the server in a JSON reponse. After this, each request sends the generated token in the Authorization: BEarer header. ...
mrrrvssmx's user avatar
7 votes
3 answers
3k views

Do we need to check for cross-origin on server side?

Modern browsers don't allow cross-origin requests - those must be explicitly allowed by CORS headers. But looking at Java back ends like Tomcat/Spring MVC I see that it's possible to reject requests ...
Stanislav Bashkyrtsev's user avatar
0 votes
1 answer
129 views

How to get my exploit script served on arbitrary subdomain?

Sometimes when checking whether requests are cross-origin, applications check whether the origin contains the whitelisted domain. This makes it possible to bypass the white-listing by including the ...
Sjoerd's user avatar
  • 30.8k
1 vote
1 answer
505 views

What is the difference between Cross Origin Opener Policy and SOP?

"The HTTP Cross-Origin-Opener-Policy (COOP) response header allows you to ensure a top-level document does not share a browsing context group with cross-origin documents." In a situation ...
Qi luo's user avatar
  • 13
0 votes
1 answer
512 views

Origin header reflected in ACAO header with ACAC set to true on an API

While reviewing an SPA web application the backend API server was reflecting the Origin header from a credentialed request in the Access-Control-Allow-Origin header of the response with Access-Control-...
RespectableMan1337's user avatar
0 votes
1 answer
979 views

CORS without Access-Control-Allow-Credentials [duplicate]

I'm testing a web application and burp detected this issue: Cross-origin resource sharing: arbitrary origin trusted Looking at the response, I only see this header: Access-Control-Allow-Origin: https:/...
moskino11's user avatar
  • 117
0 votes
2 answers
172 views

how to determine CORS Browser state

How do I determine the current CORS "state" in different browsers? I have for example a case where two different Access-Control-Allow-Origin headers are set, and I want to know which one ...
Kingflomb's user avatar
  • 118
0 votes
0 answers
108 views

How can I secure an API used for app secret keys without using CORS, created using AWS API gateway?

I am using an API , made using an AWS service named API Gateway [Which may not be of great importance]. I have gone through various articles mentioning that rather than storing secret keys directly on ...
Jidnyesh AJ's user avatar
1 vote
2 answers
304 views

What is the use of Access-Control-Allow-Headers for unauthenticated endpoints?

I understand that servers might want to prevent bad origins somehow stealing certain data and crafting a request to request some authorized data from a different domain. Such as using "...
Gopal's user avatar
  • 141
2 votes
2 answers
5k views

Difference between `Access-Control-Allow-Origin: *` (wildcard) and specific origins

I have a mostly public API with some parts of it "credentialed" behind cookies, similarly to e.g. how WordPress' REST API works. (In our case, it's a GraphQL API but that shouldn't matter.) ...
Borek Bernard's user avatar
2 votes
1 answer
559 views

CORS configuration for service with single browser client

Please note: although I mention Spring Boot (and by proxy, Java) I believe this is a pure HTTP/web development question at heart, and as such, can be answered by anyone with CORS-configuration ...
hotmeatballsoup's user avatar
0 votes
1 answer
1k views

CORS with access-control-allow-credentials

Am I correct in assuming that setting the 'access-control-allow-credentials True' header, even if you are not including the 'access-control-allow-origin' header is potentially dangerous for a website? ...
Fresh's user avatar
  • 25
1 vote
0 answers
573 views

Should I strip the "Origin" header from client requests?

I'm trying to setup an nginx reverse proxy to a web product I can't modify (it's an appliance). Client --> https://myapp.com --> nginx --> https://10.1.5.9 I managed to do so, but it ...
AoA's user avatar
  • 11
0 votes
2 answers
388 views

Is there an issue if application responds with access control allow origin * but there is no allow credentials header?

Since application is not responding with allow credentials header, an attacker can't craft cross domain request with cookies, but I was wondering if allow origin * alone (Without credentials being ...
Jack's user avatar
  • 1
5 votes
1 answer
3k views

Does CORS interact with WebAssembly the same way it does with Javascript?

Anyone in the WebAppSec world is familiar with CORS as a mechanism to specify policy for when javascript is allowed to make API calls to different domains. As WebAssembly ("Wasm" - a binary ...
Mike Ounsworth's user avatar
1 vote
2 answers
801 views

Cookie-to-Header CSRF protection vs CORS

What advantages does a Cookie-to-header technique give over CORS in a cross-origin request scenario? Example scenario: A rest API called api.com provides data to good.com. api.com has allowlisted ...
Karlis Filipsons's user avatar
1 vote
1 answer
188 views

Can the Origin header have alphabetical port or parameters in a real-life scenario?

I'm testing this application which is properly validating origin header on the sever side. However, if I add any domain and the expect domain as port, application still consider this valid. Origin: ...
Jack's user avatar
  • 11
28 votes
7 answers
15k views

How do hackers trick frontend validation?

I've always read: Put validations in the backend. Frontend validations are for UX, not security. This is because bad actors can trick frontend validation. But I'm having a hard time wrapping my head ...
Dashiell Rose Bark-Huss's user avatar
0 votes
0 answers
43 views

A potentially simpler same origin policy? [duplicate]

I know there are lots of posts on the same origin policy, but I specifically want to understand why it can't be done in this simpler way. If evil.com makes sends a request to bank.com, browsers will ...
curiousgeorge's user avatar
0 votes
1 answer
609 views

Permissive CORS - Arbitrary Origin Trust, Remedial Action?

I was completing an assessment for a client and discovered that web application implemented a Permissive CORS policy which allowed for a Arbitrary Origin Trust. Request: Host: [REDACTED] User-agent: ...
SecGuy45's user avatar
1 vote
1 answer
244 views

Is server side CORS protection enough to mitigate CSRF attacks against stateless APIs?

Assume an Angular SPA application on www.example.com that works invoking an API over that same domain www.example.com/api/... The Angular app gets a session cookie and sends it in each API call. The ...
codependent's user avatar
0 votes
1 answer
260 views

Are there security issues around controlled cross site sharing behind SSO?

Very simply we have a ton of websites at our company behind SSO. I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get ...
blankip's user avatar
  • 118
0 votes
1 answer
208 views

Protecting an external authentication server against CSRF

I have a web application which uses an external authentication server for obtaining a session. When a client tries to login, the browser is making requests towards the external authentication server ...
ficabj5's user avatar
  • 23
0 votes
0 answers
63 views

How can the CSRF happen if browsers do not allow cross-origin requests by default? [duplicate]

How can the CSRF happen if browsers do not allow cross-origin requests by default? Here is a brief CSRF overview, which is relevant for the question. CSRF (i.e. cross-site request forgery) is a type ...
Sasuke Uchiha's user avatar
1 vote
1 answer
1k views

Is it safe to add "Access-Control-Allow-Origin:*" to an API endpoint with custom authentication via header?

Lets say I have a site at myapp.com that talks to the api at myapi.com. For that to work I have to turn on CORS. I want to do it like that: Access-Control-Allow-Origin: * and my API authentication is ...
Ilya Chernomordik's user avatar
0 votes
0 answers
104 views

Secure authentication for sites which allow user to modify js/html

We have a site builder, allows users to add/modify JS/HTML/CSS. Is it possible to provide a global authentication for it? I mean users login once but can interact with all sites as their own names. ...
hjahan's user avatar
  • 101
1 vote
0 answers
502 views

What is meaning of setting port number to NULL in document.domain call?

Here (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) it is mentioned The port number is checked separately by the browser. Any call to document.domain, including document....
positron's user avatar
  • 165
1 vote
0 answers
224 views

Vulnerability Reporting from "random" dude

A few days ago I got an email to our dpo email address from a person I don't know who claims to be a Security Researcher. The email is well written and contains a POC with screenshots of a CORS ...
markus-tharkun's user avatar
6 votes
2 answers
11k views

Can we use CORS policy to restrict API calls from native mobile app?

We can use CORS to restrict API calls to a specific host in a web app. How to do the same for native mobile app? I want to restrict API calls from my app alone. Is it possible to do so?
Yuvaraj V's user avatar
  • 163