Questions tagged [cors]

Cross Origin Resource Sharing (CORS) lets servers specify what origins can access resources through XHR by setting HTTP headers (e.g. Access-Control-Allow-Origin).

Filter by
Sorted by
Tagged with
-1
votes
0answers
60 views

how did hackers do the CSRF router hacking while CORS policy exist?

about attacks like this where the do change the router dns using malicious code on fake sites or ads ... how these sites were allowed to access the router while routers doesn't have Access-Control-...
1
vote
3answers
167 views

How to stop app from fetching data from my website?

I am running a website that contains data that our users can access if they login. Someone else has created an Android app that lets users access that data as well. They enter their credentials, and ...
1
vote
1answer
131 views

Exploitability of allowed wildcard (*) CORS Origins with Bearer Token Authorization [duplicate]

I'm looking at the following setup. A web application uses a REST API to communicate with the server. All API responses include Origin: *. For authorization Authorization: Bearer <token> is used....
0
votes
1answer
46 views

access-control-allow-headers: * is being ignored

Although the OPTIONS returns * for Allow-Headers I'm getting the following CORS response. Access to XMLHttpRequest at 'https://example1.com' from origin 'https://example2.net' has been blocked by ...
0
votes
1answer
56 views

How to authorize access to a resource when requested with CORS and validate the origin?

I'll try to make the explanation simple and to the point (keyword try). And if that's not sufficient, then maybe I can expand on the question. Imagine two sites: resources.example.com and www.example....
3
votes
0answers
88 views

Is it possible to exploit this cors?

I found an xss on subdomain.example.com and i verified that the domain api.example.com accepts subdomain.example.com as valid origin. Can i exploit this as cors by inserting a CORS script in subdomain....
1
vote
1answer
86 views

How can the Same Origin Policy protect the user in times of CORS headers?

How can the Same origin policy protect something if you can bypass it via Cross Origin Resource Sharing headers? And why are those assigned by the server which is tried to access and not by the user? ...
0
votes
1answer
58 views

Is this CORS exploitable?

So i was able to upload a html file on a server i'm allowed to test. The file is uploaded on a subdomain of the main server. Knowing that they allow CORS for anything.domain.com, is it possible to ...
1
vote
1answer
88 views

What's the purpose of the preflight check on CORS requests?

A fellow developer and I were experiencing a weird issue with our application in the past couple of days. Specifically, he's writing the API and I'm writing the web front end. Since the UI runs from ...
1
vote
1answer
51 views

CORS mis-configuration

I need to crate a PoC in order to exploit a CORS mis-configuration. I'have discovered that the vulnerable server implements a poor whitelist policy that checks if substrings are in the whitelist. So ...
1
vote
1answer
63 views

Is xhr.withCredentials making POST endpoints vulnerable to CSRF?

From what I've seen, someone can add the following code to a malicious site (lets say: http://sth.malicioussite.com) and be able to perform ajax post requests to a 3rd party site, along with any ...
1
vote
0answers
42 views

How x-permitted-cross-domain-policies is different from CORS(cross origin resource sharing)? [duplicate]

OWASP is recommending x-permitted-cross-domain header. I gone through many websites and blogs and didn't get to know the difference between x-permitted-cross-domain and CORS. Since I have implemented ...
0
votes
0answers
46 views

What's the attack vector for authenticated wildcard CORS origin for a public API?

I have a public API (intended to be used by third-party websites) authentication only via JWT bearer tokens (no cookie authentication). SPAs have to add the Authorization header for every API request....
4
votes
1answer
673 views

How to implement CSRF protection with a cross origin request (CORS)

tl;dr the Cookie-to-header-token method can't work due to the CSRF token cookie not being readable by the client in any way. Is sending the token in a header, and having the client save it in a cookie ...
1
vote
1answer
237 views

How can I securely disable CSRF validation for native clients when browser clients access the same API?

I have an API endpoint that is accessible by both native (console, mobile apps) and Javascript based clients. How do I ensure that the CSRF AntiForgeryToken is only invoked during Javascript calls? ...
0
votes
0answers
48 views

How does SupportsCredentials, Access-Control-Allow-Credentials, and CORS Origin=* relate?

I'm investigating CSRF implementations in ASP.NET, MVC, WebAPI the relationship between the headers that are sent: A Javascript client call of XMLHttpRequest.withCredentials A server response of ...
0
votes
1answer
248 views

Do I correctly understand how CORS proxy works?

There are a lot of CORS proxy servers like this one: https://cors-anywhere.herokuapp.com/ This allows us to send requests from different origins. For example I can send request from my client's ...
0
votes
1answer
197 views

What scenario does CORS protect against?

My understanding of the same origin policy is that it prevents scripts from making requests to resources outside of the domain from which they originated. One motivation of this is to prevent a ...
1
vote
2answers
347 views

Why do browsers disallow accessing files from local file system even if the HTML document is also on the local file system?

Many browsers do not allow you to access files on the local filesystem with JavaScript (even if the HTML document is also on the local filesystem). (source) Yes I know that the solution is to "...
1
vote
0answers
35 views

Origin VS Authority and Domain certificates and Unique IPs

Disclaimer, I am new to InformationSecurity, so sorry if I not following rules as good as expected. I asked this post on stackOverflow, and I was suggested to transfer it here So far I get: Origin = ...
1
vote
1answer
212 views

CORS accepting arbitrary origin with GET but not with OPTIONS

I'm testing an API, which allows an arbitrary origin on POST/GET requests, by responding with the CORS header Access-Control-Allow-Origin: *. However, with OPTIONS requests and an arbitrary origin, ...
2
votes
1answer
2k views

Access-Control-Allow-Origin wildcard doesnt allow sending session cookies

I always thought CORS restrictions was to disable the following scenario: I enter attacker.com, JS sends GET facebook.com, my browser adds my cookies, attacker.com has access to my facebook profile/...
0
votes
1answer
322 views

How to steal cookie on website with cors?

When I make a cross origin request to example.com from anysite.com with req.withCredentials = "true"; cookies are included in the request The response contains access-control-allow-origin: https://...
0
votes
1answer
30 views

Is there any other way through which an attacker can obtain user data from HTTP response except MITM and CORS attack?

I am doing some research for my college project and I want to ask is there any other way through which an attacker can obtain data from HTTP response except MITM and CORS attack. For an example, If I ...
0
votes
1answer
65 views

Getting confusion that this responce indicate CORS vulnerability

HTTP/1.1 200 OK Content-Type: application/json Content-Length: 12 Connection: close Date: Tue, 25 Sep 2018 12:59:56 GMT x-amzn-RequestId: xxxxxxxxxxx Access-Control-Allow-Origin: * Access-Control-...
2
votes
1answer
557 views

Web-Application with CORS Origin: * using authorization header

As stated here, https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS at "Credentialed requests and wildcards". Quote: When responding to a credentialed request, the server must specify an ...
2
votes
2answers
1k views

XMLHttpRequest CSRF fails with allowed CORS

I'm currently working on a PoC for a CSRF attack, which should be possible due to the lax CORS configuration. I have a permission to attack. Now the following code should send a OPTIONS request, ...
0
votes
1answer
77 views

What party is protected by not turning on CORS?

Here's what I know about CORS: It allows you to access data on another domain from the frontend of any other website, as long as the access-control-allow-origin property is properly set on the machine ...
3
votes
1answer
726 views

CSRF Protection Is Needed for GET Requests

I have a REST API that allows authenticated users to read data about their own account and make changes to their accounts. For authentication I use JWTs stored as httpOnly cookies. To protect against ...
2
votes
1answer
2k views

How do CORS proxy websites work?

While I was developing the front-end side of my web project, I got an CORS protection error. Not surprising since my front-end project was not in the same origin. After some search on how to bypass ...
1
vote
1answer
371 views

Is it possible to send cookies from third party server to browser using CORS

UPDATED FROM THE LAST QUESTION WITH MORE DETAILS I'm building a full javascript app from Salesforce.com API with no server side script that will be hosted on salesforce.com domain (https) This app ...
1
vote
1answer
985 views

XMLHttpRequest with preflighted CORS missing authorization token

I have a followup question to this older question: How to exploit a misconfigured CORS policy when a per user authorization token is required? According to the documentation here, the Access-Control-...
2
votes
1answer
380 views

Why is the same origin policy sensible - for requests?

This is not the same question as Why is the same origin policy so important?. That one asks only about why cookies are only ever send to origin they came from, which I understand. What I don't ...
0
votes
0answers
188 views

CORS returning two Access-Control-Allow-Origin headers?

I am doing a verification test for a CORS issue that we discovered. When specifying an origin, the application used to respond with the allow origin to any URL. However, upon retest, the application ...
2
votes
1answer
194 views

When implementing CORS, should I check for a correct HOST header in my webapp?

I have a backend web server that serves an API (over HTTPS) to a frontend browser client on a different subdomain. It uses CORS to allow this. The CORS spec directs you to not send the CORS headers ...
0
votes
2answers
710 views

is every site without a CSRF token vulnerable to CSRF attack?

I found a lot of popular sites not having crsf token in cookie header, does that mean all of these sites are vulnerable? I tried to learn more about it and found there's something called CORS which ...
3
votes
0answers
68 views

What are the design considerations behind exempting WebSockets from the SOP?

I was rather surprised that in my experiments, I could simply connect from one website to a WebSocket server on a different domain/port pair. Subsequent research repeatedly showed that WebSockets do ...
1
vote
0answers
41 views

Why doesn't a CORS preflight request cause another?

According to MDN documentation, every non-simple request is doomed to fall into an infinite recursion: I want to send a non-simple CORS request (with the verb PUT e.g.) My browser tries to send a ...
2
votes
1answer
627 views

Why CORS preflight is not available for POST requests when Content-Type is application/x-www-form-urlencoded

In oauth2 for single page application(SPA), we can revoke the access tokens of the implicit grant type by using an ajax request(this is not recommended now). I tried to do a request like below from ...
5
votes
1answer
459 views

Is it secure to use CORS to implement SSO?

I implement SSO to integrate some web login mechanism to the centralized member system which is OAuth2 provider. And currently OAuth2 authorization works well. However, I would like to implement much ...
1
vote
1answer
508 views

Is CORS and CSRF-tokens only for POST and GET requests? [closed]

I have the following questions regarding CSRF, SOP and CORS. Does CSRF tokens only protect form submission with either POST or GET methods? Is this just a "common practice" (regarding the fact that ...
1
vote
2answers
487 views

CORS Exploitation and POC [closed]

How do I exploit an application returning headers as the following Access-Control-Allow-Origin: * What exact information do we get if the following is set to * To make it concise, If an application ...
4
votes
1answer
696 views

BeEF XSS - internal working

I am studying BeEf XSS as I think it is a very interesting tool for a penetration tester, but I have a couple of doubts about it, in particular when linking it to Cross Domain Request. So, in some ...
2
votes
2answers
81 views

Why return successfully to non-allowed origins

As I understand it, with CORS, on cross-origin requests, the browser will send an Origin header, and if the origin isn't allowed, the server will still send back a 200 response with a non-matching ...
0
votes
1answer
348 views

Preventing CSRF/XSS on mobile/web shared API

I have inherited a code-base that includes a mobile & web app that both access the same API and have been tasked with fixing some of the security holes that exist, unfortunately I am not well-...
1
vote
2answers
109 views

CORS clarification

I need some clarifications about the problems that CORS (Cross-Origin Resource Sharing) can cause. Let's suppose that site A.COM has enabled CORS, in particular: Access-Control-Allow-Origin can be ...
0
votes
1answer
237 views

Securely embedding a widget submitting forms to our servers on third party websites?

I would like to build a javascript widget that third party developers inject on their page by adding: <script type="text/javascript" src="https://test.com/widget.js" async></script> The ...
4
votes
0answers
3k views

Configure Access-Control-Allow-Origin for clients with origin: null

I develop a web app. When I run the app on Android, origin in the header of a network request is null. Access-Control-Allow-Origin in the response header is null too, because the origin of the ...
5
votes
1answer
224 views

Are restrictive same origin policies necessary?

The question is for the security community to resolve some misunderstandings here. The crux: Company (Wire) has a client (official-client.com) and a server code (e.g. official-server.com ). CORS ...
9
votes
1answer
700 views

Why is a “tainted canvas” a risk?

I understand the concern about a tainted canvas - the idea that the bits of an image from another site can be sent back to a malicious server. But can you explain the details of how exactly this works?...