Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cors]

Cross Origin Resource Sharing (CORS) lets servers specify what origins can access resources through XHR by setting HTTP headers (e.g. Access-Control-Allow-Origin).

0
votes
0answers
12 views

What's the attack vector for authenticated wildcard CORS origin for a public API?

I have a public API (intended to be used by third-party websites) authentication only via JWT bearer tokens (no cookie authentication). SPAs have to add the Authorization header for every API request....
4
votes
1answer
92 views

How to implement CSRF protection with a cross origin request (CORS)

tl;dr the Cookie-to-header-token method can't work due to the CSRF token cookie not being readable by the client in any way. Is sending the token in a header, and having the client save it in a cookie ...
1
vote
1answer
49 views

How can I securely disable CSRF validation for native clients when browser clients access the same API?

I have an API endpoint that is accessible by both native (console, mobile apps) and Javascript based clients. How do I ensure that the CSRF AntiForgeryToken is only invoked during Javascript calls? ...
0
votes
0answers
22 views

How does SupportsCredentials, Access-Control-Allow-Credentials, and CORS Origin=* relate?

I'm investigating CSRF implementations in ASP.NET, MVC, WebAPI the relationship between the headers that are sent: A Javascript client call of XMLHttpRequest.withCredentials A server response of ...
0
votes
1answer
69 views

Do I correctly understand how CORS proxy works?

There are a lot of CORS proxy servers like this one: https://cors-anywhere.herokuapp.com/ This allows us to send requests from different origins. For example I can send request from my client's ...
0
votes
1answer
86 views

What scenario does CORS protect against?

My understanding of the same origin policy is that it prevents scripts from making requests to resources outside of the domain from which they originated. One motivation of this is to prevent a ...
1
vote
2answers
78 views

Why do browsers disallow accessing files from local file system even if the HTML document is also on the local file system?

Many browsers do not allow you to access files on the local filesystem with JavaScript (even if the HTML document is also on the local filesystem). (source) Yes I know that the solution is to "...
1
vote
0answers
30 views

Origin VS Authority and Domain certificates and Unique IPs

Disclaimer, I am new to InformationSecurity, so sorry if I not following rules as good as expected. I asked this post on stackOverflow, and I was suggested to transfer it here So far I get: Origin = ...
1
vote
1answer
81 views

CORS accepting arbitrary origin with GET but not with OPTIONS

I'm testing an API, which allows an arbitrary origin on POST/GET requests, by responding with the CORS header Access-Control-Allow-Origin: *. However, with OPTIONS requests and an arbitrary origin, ...
1
vote
1answer
859 views

Access-Control-Allow-Origin wildcard doesnt allow sending session cookies

I always thought CORS restrictions was to disable the following scenario: I enter attacker.com, JS sends GET facebook.com, my browser adds my cookies, attacker.com has access to my facebook profile/...
0
votes
1answer
208 views

How to steal cookie on website with cors?

When I make a cross origin request to example.com from anysite.com with req.withCredentials = "true"; cookies are included in the request The response contains access-control-allow-origin: https://...
0
votes
1answer
26 views

Is there any other way through which an attacker can obtain user data from HTTP response except MITM and CORS attack?

I am doing some research for my college project and I want to ask is there any other way through which an attacker can obtain data from HTTP response except MITM and CORS attack. For an example, If I ...
0
votes
1answer
60 views

Getting confusion that this responce indicate CORS vulnerability

HTTP/1.1 200 OK Content-Type: application/json Content-Length: 12 Connection: close Date: Tue, 25 Sep 2018 12:59:56 GMT x-amzn-RequestId: xxxxxxxxxxx Access-Control-Allow-Origin: * Access-Control-...
1
vote
1answer
292 views

Web-Application with CORS Origin: * using authorization header

As stated here, https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS at "Credentialed requests and wildcards". Quote: When responding to a credentialed request, the server must specify an ...
2
votes
2answers
516 views

XMLHttpRequest CSRF fails with allowed CORS

I'm currently working on a PoC for a CSRF attack, which should be possible due to the lax CORS configuration. I have a permission to attack. Now the following code should send a OPTIONS request, ...
0
votes
1answer
64 views

What party is protected by not turning on CORS?

Here's what I know about CORS: It allows you to access data on another domain from the frontend of any other website, as long as the access-control-allow-origin property is properly set on the machine ...
3
votes
1answer
414 views

CSRF Protection Is Needed for GET Requests

I have a REST API that allows authenticated users to read data about their own account and make changes to their accounts. For authentication I use JWTs stored as httpOnly cookies. To protect against ...
2
votes
1answer
875 views

How do CORS proxy websites work?

While I was developing the front-end side of my web project, I got an CORS protection error. Not surprising since my front-end project was not in the same origin. After some search on how to bypass ...
1
vote
1answer
268 views

Is it possible to send cookies from third party server to browser using CORS

UPDATED FROM THE LAST QUESTION WITH MORE DETAILS I'm building a full javascript app from Salesforce.com API with no server side script that will be hosted on salesforce.com domain (https) This app ...
0
votes
1answer
553 views

XMLHttpRequest with preflighted CORS missing authorization token

I have a followup question to this older question: How to exploit a misconfigured CORS policy when a per user authorization token is required? According to the documentation here, the Access-Control-...
2
votes
1answer
280 views

Why is the same origin policy sensible - for requests?

This is not the same question as Why is the same origin policy so important?. That one asks only about why cookies are only ever send to origin they came from, which I understand. What I don't ...
0
votes
0answers
165 views

CORS returning two Access-Control-Allow-Origin headers?

I am doing a verification test for a CORS issue that we discovered. When specifying an origin, the application used to respond with the allow origin to any URL. However, upon retest, the application ...
2
votes
1answer
92 views

When implementing CORS, should I check for a correct HOST header in my webapp?

I have a backend web server that serves an API (over HTTPS) to a frontend browser client on a different subdomain. It uses CORS to allow this. The CORS spec directs you to not send the CORS headers ...
0
votes
2answers
442 views

is every site without a CSRF token vulnerable to CSRF attack?

I found a lot of popular sites not having crsf token in cookie header, does that mean all of these sites are vulnerable? I tried to learn more about it and found there's something called CORS which ...
3
votes
0answers
56 views

What are the design considerations behind exempting WebSockets from the SOP?

I was rather surprised that in my experiments, I could simply connect from one website to a WebSocket server on a different domain/port pair. Subsequent research repeatedly showed that WebSockets do ...
1
vote
0answers
37 views

Why doesn't a CORS preflight request cause another?

According to MDN documentation, every non-simple request is doomed to fall into an infinite recursion: I want to send a non-simple CORS request (with the verb PUT e.g.) My browser tries to send a ...
2
votes
1answer
432 views

Why CORS preflight is not available for POST requests when Content-Type is application/x-www-form-urlencoded

In oauth2 for single page application(SPA), we can revoke the access tokens of the implicit grant type by using an ajax request(this is not recommended now). I tried to do a request like below from ...
5
votes
1answer
332 views

Is it secure to use CORS to implement SSO?

I implement SSO to integrate some web login mechanism to the centralized member system which is OAuth2 provider. And currently OAuth2 authorization works well. However, I would like to implement much ...
0
votes
1answer
441 views

Is CORS and CSRF-tokens only for POST and GET requests? [closed]

I have the following questions regarding CSRF, SOP and CORS. Does CSRF tokens only protect form submission with either POST or GET methods? Is this just a "common practice" (regarding the fact that ...
1
vote
2answers
389 views

CORS Exploitation and POC [closed]

How do I exploit an application returning headers as the following Access-Control-Allow-Origin: * What exact information do we get if the following is set to * To make it concise, If an application ...
3
votes
1answer
630 views

BeEF XSS - internal working

I am studying BeEf XSS as I think it is a very interesting tool for a penetration tester, but I have a couple of doubts about it, in particular when linking it to Cross Domain Request. So, in some ...
2
votes
2answers
79 views

Why return successfully to non-allowed origins

As I understand it, with CORS, on cross-origin requests, the browser will send an Origin header, and if the origin isn't allowed, the server will still send back a 200 response with a non-matching ...
0
votes
1answer
274 views

Preventing CSRF/XSS on mobile/web shared API

I have inherited a code-base that includes a mobile & web app that both access the same API and have been tasked with fixing some of the security holes that exist, unfortunately I am not well-...
1
vote
2answers
92 views

CORS clarification

I need some clarifications about the problems that CORS (Cross-Origin Resource Sharing) can cause. Let's suppose that site A.COM has enabled CORS, in particular: Access-Control-Allow-Origin can be ...
0
votes
1answer
147 views

Securely embedding a widget submitting forms to our servers on third party websites?

I would like to build a javascript widget that third party developers inject on their page by adding: <script type="text/javascript" src="https://test.com/widget.js" async></script> The ...
4
votes
0answers
3k views

Configure Access-Control-Allow-Origin for clients with origin: null

I develop a web app. When I run the app on Android, origin in the header of a network request is null. Access-Control-Allow-Origin in the response header is null too, because the origin of the ...
5
votes
1answer
177 views

Are restrictive same origin policies necessary?

The question is for the security community to resolve some misunderstandings here. The crux: Company (Wire) has a client (official-client.com) and a server code (e.g. official-server.com ). CORS ...
9
votes
1answer
602 views

Why is a “tainted canvas” a risk?

I understand the concern about a tainted canvas - the idea that the bits of an image from another site can be sent back to a malicious server. But can you explain the details of how exactly this works?...
1
vote
2answers
627 views

CSRF with a CORS JSON API [duplicate]

We have api.example.com that communicates with app.example.com, a native Android app and an iOS app. We want to allow other third parties to communicate with the API too if they want, and as such we ...
0
votes
1answer
42 views

Can Origin headers be sent with get variables or the whole url?

An application I'm working on responds to a wildcard Origin header by setting the Access-Control-Allow-Origin to subdomain.app.com if ending with .app.com. However, if I append .app.com to a GET ...
0
votes
1answer
4k views

Check for insecure CORS settings with cURL

I'm trying to verify the CORS settings of a website using cURL. The following command should let me check whether the CORS settings can be considered as secure or if requests may be made across ...
1
vote
1answer
1k views

How to verify CORS policy implementation?

We've added Access-Control-Allow-Origin: *.domain.com and I'm able to view this in the response header. But how can I make sure this is implemented in the right way. When I modify Origin or Referer ...
7
votes
2answers
2k views

How does setting Origin to null in a redirected CORS request protect against a confused deputy attack?

Excerpt from Here: If a cross-origin resource redirects to another resource at a new origin, the browser will set the value of the Origin header to null after redirecting. This prevents additional ...
0
votes
0answers
112 views

Does SOP helps against CSRF attacks? [duplicate]

I guess my true questions is why do you need csrf token and SOP (strict CORS policy isn't enough). CSRF: when evil.com makes request to bank.com/logout If evil.com does it through XHR, then browser ...
2
votes
2answers
2k views

Is it safe to set “Access Control Allow Origin” header's value to the “Origin” header's value which is implicitly set by the browser?

I was testing a website and noticed that changing the "Origin" Header's value of a request with an intercepting proxy application results in the web application sending a response with "Access Control ...
2
votes
2answers
815 views

HTTP access control (CORS) purpose

As there is an option to disable HTTP access control (CORS) in browsers, so I can send requests to any origin. So why should I bother to run a Browser with CORS enabled?
2
votes
1answer
417 views

Why do we use CORS?

I am confused about why websites use CORS. I know CORS provide some protocols through which website can call the resources from other domains, but is it possible to call the resource without CORS? If ...
3
votes
2answers
1k views

custom Origin header to bypass CORS protection against CSRF

CORS (cross-origin ressource sharing) can be used to protect webapps from CSRF, before accepting a request, the server verifies that the host specified in the Origin header is among the hosts allowed ...
1
vote
2answers
1k views

Is a single page application naturally breaking the same-origin policy?

Assume that you have a web application. The backend API is deployed at api.example.com and your frontend SPA is deployed at frontend.example.com. When you open it you download all the resources to ...
0
votes
0answers
2k views

CORS: What is the most secure set up for mobile app talking to backend API?

I'm currently building a mobile app which is talking to a backend API. Additionally I have a webapp with a seperate server also accessing the backend API. Authorization happens via a JWT token passed ...