Questions tagged [cors]

Cross Origin Resource Sharing (CORS) lets servers specify what origins can access resources through XHR by setting HTTP headers (e.g. Access-Control-Allow-Origin).

Filter by
Sorted by
Tagged with
-2 votes
1 answer
31 views

CORS attack using authentication token [closed]

I found a website which is vulnerable to cors.(https://portswigger.net/web-security/cors) GET /api/requestApiKey HTTP/1.1. Host: vulnerable-website.com. Origin: https://evil.com. AUTHENTICATION: ...
user avatar
0 votes
1 answer
38 views

Why is Content Security Policy necessary given Same Origin Policy?

Given that Same Origin Policy prevents JavaScript from one origin from running in another origin and accessing another origin's cookies, why is CSP necessary? Is it that CORS selectively removes some ...
user avatar
  • 412
0 votes
1 answer
218 views

CORS request is not sending Authorization: Bearer <value> header

When loggin in to a website, A Bearer token is generated and echoed back from the server in a JSON reponse. After this, each request sends the generated token in the Authorization: BEarer header. ...
user avatar
3 votes
2 answers
531 views

Do we need to check for cross-origin on server side?

Modern browsers don't allow cross-origin requests - those must be explicitly allowed by CORS headers. But looking at Java back ends like Tomcat/Spring MVC I see that it's possible to reject requests ...
user avatar
0 votes
1 answer
51 views

How to get my exploit script served on arbitrary subdomain?

Sometimes when checking whether requests are cross-origin, applications check whether the origin contains the whitelisted domain. This makes it possible to bypass the white-listing by including the ...
user avatar
  • 28.5k
0 votes
1 answer
49 views

What is the difference between Cross Origin Opener Policy and SOP?

"The HTTP Cross-Origin-Opener-Policy (COOP) response header allows you to ensure a top-level document does not share a browsing context group with cross-origin documents." In a situation ...
user avatar
  • 3
0 votes
1 answer
102 views

Origin header reflected in ACAO header with ACAC set to true on an API

While reviewing an SPA web application the backend API server was reflecting the Origin header from a credentialed request in the Access-Control-Allow-Origin header of the response with Access-Control-...
user avatar
0 votes
0 answers
55 views

Unknown vulnerability name Referer header and Access-Control-Allow-Origin

When reviewing an application, I saw the "Access-Control-Allow-Origin" header as a response. When I modified the "Origin" header in the request, I got a 404, which was fine. So no ...
user avatar
0 votes
0 answers
65 views

Ways of Authentication in case server and client are hosted on different domains

I´m working on a project where user authentication is required. For some reasons we have to host the frontend and the backend on different domains. I usually send httponly cookies from server to ...
user avatar
  • 101
0 votes
1 answer
164 views

CORS without Access-Control-Allow-Credentials [duplicate]

I'm testing a web application and burp detected this issue: Cross-origin resource sharing: arbitrary origin trusted Looking at the response, I only see this header: Access-Control-Allow-Origin: https:/...
user avatar
  • 107
0 votes
2 answers
108 views

how to determine CORS Browser state

How do I determine the current CORS "state" in different browsers? I have for example a case where two different Access-Control-Allow-Origin headers are set, and I want to know which one ...
user avatar
  • 118
0 votes
0 answers
73 views

How can I secure an API used for app secret keys without using CORS, created using AWS API gateway?

I am using an API , made using an AWS service named API Gateway [Which may not be of great importance]. I have gone through various articles mentioning that rather than storing secret keys directly on ...
user avatar
1 vote
2 answers
123 views

What is the use of Access-Control-Allow-Headers for unauthenticated endpoints?

I understand that servers might want to prevent bad origins somehow stealing certain data and crafting a request to request some authorized data from a different domain. Such as using "...
user avatar
  • 141
0 votes
2 answers
631 views

Difference between `Access-Control-Allow-Origin: *` (wildcard) and specific origins

I have a mostly public API with some parts of it "credentialed" behind cookies, similarly to e.g. how WordPress' REST API works. (In our case, it's a GraphQL API but that shouldn't matter.) ...
user avatar
0 votes
0 answers
254 views

Block Cross-Origin requests for Youtube embedded video (with js api)

I am developing webpage in which I am embedding some Youtube video's. On my localhost environment I get the following errors: "Cross-Origin Request Blocked: The Same Origin Policy disallows ...
user avatar
  • 263
0 votes
0 answers
79 views

How risky it is if a server allows client Javascript access to say an access token in header?

After authenticated by Google, a client browser attaches the idToken from Google to an application API server. Assuming google-auth-library auto-refresh an expired token, it now needs to send it back ...
user avatar
  • 101
2 votes
1 answer
162 views

CORS configuration for service with single browser client

Please note: although I mention Spring Boot (and by proxy, Java) I believe this is a pure HTTP/web development question at heart, and as such, can be answered by anyone with CORS-configuration ...
user avatar
0 votes
1 answer
200 views

CORS with access-control-allow-credentials

Am I correct in assuming that setting the 'access-control-allow-credentials True' header, even if you are not including the 'access-control-allow-origin' header is potentially dangerous for a website? ...
user avatar
  • 25
0 votes
0 answers
123 views

Should I strip the "Origin" header from client requests?

I'm trying to setup an nginx reverse proxy to a web product I can't modify (it's an appliance). Client --> https://myapp.com --> nginx --> https://10.1.5.9 I managed to do so, but it ...
user avatar
  • 1
0 votes
2 answers
208 views

Is there an issue if application responds with access control allow origin * but there is no allow credentials header?

Since application is not responding with allow credentials header, an attacker can't craft cross domain request with cookies, but I was wondering if allow origin * alone (Without credentials being ...
user avatar
  • 1
4 votes
1 answer
1k views

Does CORS interact with WebAssembly the same way it does with Javascript?

Anyone in the WebAppSec world is familiar with CORS as a mechanism to specify policy for when javascript is allowed to make API calls to different domains. As WebAssembly ("Wasm" - a binary ...
user avatar
1 vote
2 answers
243 views

Cookie-to-Header CSRF protection vs CORS

What advantages does a Cookie-to-header technique give over CORS in a cross-origin request scenario? Example scenario: A rest API called api.com provides data to good.com. api.com has allowlisted ...
user avatar
0 votes
1 answer
100 views

Can the Origin header have alphabetical port or parameters in a real-life scenario?

I'm testing this application which is properly validating origin header on the sever side. However, if I add any domain and the expect domain as port, application still consider this valid. Origin: ...
user avatar
  • 1
27 votes
7 answers
10k views

How do hackers trick frontend validation?

I've always read: Put validations in the backend. Frontend validations are for UX, not security. This is because bad actors can trick frontend validation. But I'm having a hard time wrapping my head ...
user avatar
0 votes
0 answers
42 views

A potentially simpler same origin policy? [duplicate]

I know there are lots of posts on the same origin policy, but I specifically want to understand why it can't be done in this simpler way. If evil.com makes sends a request to bank.com, browsers will ...
user avatar
0 votes
1 answer
174 views

Permissive CORS - Arbitrary Origin Trust, Remedial Action?

I was completing an assessment for a client and discovered that web application implemented a Permissive CORS policy which allowed for a Arbitrary Origin Trust. Request: Host: [REDACTED] User-agent: ...
user avatar
1 vote
1 answer
143 views

Is server side CORS protection enough to mitigate CSRF attacks against stateless APIs?

Assume an Angular SPA application on www.example.com that works invoking an API over that same domain www.example.com/api/... The Angular app gets a session cookie and sends it in each API call. The ...
user avatar
0 votes
1 answer
170 views

Are there security issues around controlled cross site sharing behind SSO?

Very simply we have a ton of websites at our company behind SSO. I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get ...
user avatar
  • 108
0 votes
1 answer
102 views

Protecting an external authentication server against CSRF

I have a web application which uses an external authentication server for obtaining a session. When a client tries to login, the browser is making requests towards the external authentication server ...
user avatar
  • 23
0 votes
0 answers
57 views

How can the CSRF happen if browsers do not allow cross-origin requests by default? [duplicate]

How can the CSRF happen if browsers do not allow cross-origin requests by default? Here is a brief CSRF overview, which is relevant for the question. CSRF (i.e. cross-site request forgery) is a type ...
user avatar
0 votes
1 answer
125 views

Is it safe to add "Access-Control-Allow-Origin:*" to an API endpoint with custom authentication via header?

Lets say I have a site at myapp.com that talks to the api at myapi.com. For that to work I have to turn on CORS. I want to do it like that: Access-Control-Allow-Origin: * and my API authentication is ...
user avatar
0 votes
0 answers
73 views

Secure authentication for sites which allow user to modify js/html

We have a site builder, allows users to add/modify JS/HTML/CSS. Is it possible to provide a global authentication for it? I mean users login once but can interact with all sites as their own names. ...
user avatar
  • 101
1 vote
0 answers
206 views

What is meaning of setting port number to NULL in document.domain call?

Here (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) it is mentioned The port number is checked separately by the browser. Any call to document.domain, including document....
user avatar
  • 165
1 vote
0 answers
158 views

Vulnerability Reporting from "random" dude

A few days ago I got an email to our dpo email address from a person I don't know who claims to be a Security Researcher. The email is well written and contains a POC with screenshots of a CORS ...
user avatar
3 votes
2 answers
3k views

Can we use CORS policy to restrict API calls from native mobile app?

We can use CORS to restrict API calls to a specific host in a web app. How to do the same for native mobile app? I want to restrict API calls from my app alone. Is it possible to do so?
user avatar
  • 133
1 vote
0 answers
97 views

Allowing 3rd-party cookies in major 2020 browsers [closed]

I'm trying to get 3rd party cookies to work on major mid-year 2020 browsers [1]. It's as simple as pointing an iframe to an external URL to make a cookied request and probably get the response ...
user avatar
  • 3,253
1 vote
2 answers
575 views

Cross-Domain Request is a CSRF Attack? (CORS)

CORS is a HTTP Suite header that “relax” the SOP. One of the CORS misconfigurations is about to reflect without reg exp the “Origin” client header into “ACAO” response header. If it happens with “ACAC:...
user avatar
2 votes
1 answer
118 views

Stuck in a tricky situation, not able to exploit misconfigured CORS

I found that this application has not properly configured CORS, an attacker can send requests from any origin and allow credentials header is also true. The idea was to extract CSRF token and then ...
user avatar
  • 21
3 votes
2 answers
1k views

What is the connection between CORS and SameSite cookie attribute?

For most of them may be its a silly question but I want it to know this in very simple language. If an application is not using CORS at all then should we put this SameSite cookie attribute? and if ...
user avatar
0 votes
1 answer
578 views

Prevent Cross-site WebSocket hijacking with a custom header and no CORS

Considering I am vulnerable to Cross-site WebSocket hijacking, so my WebSocket handshake (GET to example.com/wss) does not require a random (CSRF) token. I have defined no CORS settings, so no custom ...
user avatar
-1 votes
1 answer
116 views

What is CORS default policy

What is CORS default policy if it's not explicitly implemented by the Web Server ?
user avatar
  • 599
2 votes
2 answers
481 views

Can cross origin iframe be detected in web logs

A recent blog post shows hackers owning a web server - at least the content and injecting a web skimming attack. https://blog.malwarebytes.com/hacking-2/2020/03/criminals-hack-tupperware-website-with-...
user avatar
  • 21
6 votes
1 answer
281 views

Concrete example of how can Access-Control-Allow-Origin:* cause security risks?

I have done some research but have not found an absolute answer to my specific question. I understand the basic concept of how this header will allow or disallow website A from sending request and ...
user avatar
  • 663
0 votes
0 answers
86 views

CORS policy during development

Does the CORS policy add any value during the development phase? Should I develop with CORS on or off? The development is occurring in a distributed environment and there are no local copies of ...
user avatar
0 votes
0 answers
113 views

How to secure API used by third-parties?

What I am building is service that can be consumed by third-party. Something like Omdb API for example. For my service to be functional I needed to disable CSRF on some endpoints. How can I secure ...
user avatar
4 votes
1 answer
424 views

Is CSRF protection required for sensitive GET requests with CORS enabled?

Based on other questions, it seems protecting GET resources with CSRF tokens is useless. However, that quickly becomes untrue when CORS gets thrown into the mix I have a server domain server.com and ...
user avatar
1 vote
2 answers
257 views

With the existence of CORS, what further purpose does same origin policy serve?

I've been using CORS for a while and I think I understand it. But as far as I can tell, because the allow-origin header is provided by the server being called, which an attacker can control as they ...
user avatar
1 vote
0 answers
283 views

Do best practices eliminate the need for a CSRF token when writing an API server?

I realize that OWASP recommends CSRF tokens but I rarely see them used with public standalone HTTP APIs. This would seem to indicate that they're not always necessary. To make this a little more ...
user avatar
  • 111
1 vote
1 answer
118 views

CORS misconfiguration

While testing a website for CORS misconfiguration, I have found that access-control-allow-origin header is being set dynamically based on host header in requests. Is it safe or can be exploited? ...
user avatar
1 vote
0 answers
456 views

Custom header to avoid CSRF attacks? header without token

I found that a website protects itself of CSRF attacks by validating the POST request contains a specific header: -Example-header: GF What i find strange is that this header doesn't have a csrf ...
user avatar