Questions tagged [cors]
Cross Origin Resource Sharing (CORS) lets servers specify what origins can access resources through XHR by setting HTTP headers (e.g. Access-Control-Allow-Origin).
179
questions
0
votes
1
answer
27
views
Understanding Cross-Domain Cookies and `SameSite` Attributes with Express.js and Third-Party Tracking
What I have understood (I guess):
Cross-origin Cookies:
Cookies set with Domain="example.com" are not sent with fetch requests from origins like hello.example2.com to mywebsite.example.com ...
- 129
3
votes
1
answer
206
views
CORS credentials option set to true
To allow cookies to be sent to my ExpressJS server,credentials: true has to be set in my CORS config.
What potential security risks/ vulnerabilities could arise from this configuration?
If possible, ...
- 73
1
vote
1
answer
56
views
Does the CORS asteriks / wildcard include both encrypted and unencrypted origins?
Does the CORS asteriks / wildcard (*) include both encrypted (https) and unencrypted origins (http)? And is the null origin (i.e., when a local file is doing a xmlhttprequest, or within an iframe ...
- 11
5
votes
1
answer
898
views
What are the reasons for CORS failure errors to not be available to JS?
From Cross-Origin Resource Sharing (CORS) - HTTP | MDN:
CORS failures result in errors but for security reasons, specifics about the error are not available to JavaScript. All the code knows is that ...
- 1,591
1
vote
0
answers
109
views
Risks with having a "localhost" service configured on a production SAML/OAuth/OIDC Identity Provider
To help developers with integrating with our SAML/OAuth/OIDC Identity Provider on their local dev environments, I'm thinking about configuring a demo client/app in our production IdP that has ...
- 178
1
vote
1
answer
495
views
Is prohibiting cookies a viable CORS alternative?
I have been using lots of various APIs in my frontend lately and they all have to be properly configured with CORS and the browser always do extra OPTIONS request that only make debugging harder.
I ...
- 2,287
4
votes
2
answers
1k
views
Do browsers have a defence against CORS from internet to intranet sites?
I was testing an internal application recently, that had fully permissive CORS, i.e. it echoes the Origin header into Access-Control-Allow-Origin, has Access-Control-Allow-Credentials: true and ...
- 34.6k
0
votes
1
answer
139
views
Certificate structure for accessing a local device from a web app
I have a pretty standard web app (react client, node server), https-enabled.
I want to add the ability for the web app to access a device on the local LAN. The device has REST APIs and I can install ...
- 101
5
votes
1
answer
2k
views
Why is the browser not sending cookies with cross-domain WebSocket handshake request?
If I have understood Cross-Site WebSocket Hijacking (CSWSH) attack correctly [1][2][3][4], the attack relies on two things (examples are from the first reference):
the browser sending the cookies set ...
- 579
0
votes
1
answer
1k
views
"CORS Error" but Chrome sent the request anyway
I have created a page to attack a CSRF unprotected endpoint.
This endpoint accepts only JSON as payload, so I have used fetch with credentials: "include" properties. The page run locally ...
1
vote
1
answer
599
views
Are CORS headers useless?
It is common to say that CORS headers protect against CSRF, so that if you visit a malicious website, it cannot make a request to your web application because the referer header (the URL of the ...
0
votes
1
answer
2k
views
Does CORS Access-Control-Allow-Credentials apply to non-origin/third-party cookies or as well?
I understand if you are cross-communicating with origin A, then if origin A has no Access-Control-Allow-Credentials in the response, you will never be able to reuse Cookies obtained from origin A ...
- 103
1
vote
2
answers
217
views
Are timing-based side-channel attacks against the server during CORS preflight a legitimate concern?
Section 3.2.3 of the Fetch standard provides some guidance about how servers can/should handle preflight requests.
A successful HTTP response, i.e., one where the server developer intends to share it,...
- 441
1
vote
0
answers
129
views
Storing auth token in html
Current projects webs application utilises a cookie based approach to store users auth token. Implemented with secure and http-only attributes set. All traffic over https. The application loads third ...
- 11
2
votes
1
answer
1k
views
Is it possible to steal a cookie without HttpOnly via CSRF?
Without giving too many details away, let's say that I'm auditing an API that:
Has access-control-allow-credentials: true
Has access-control-allow-origin: *
Needs JWT set in Authorization header for ...
- 35
2
votes
0
answers
107
views
Auth Token not included in CORS exploit [closed]
I have found a CORS on a website but when I am trying to exploit it for a POC it is fetching all the cookies except auth cookies and due to that I am getting an error message to "User not logged ...
0
votes
1
answer
718
views
WP-JSON: Cross Origin Resource Sharing Vulnerability?
I am testing the security of a webpage owned by the company I work for. I noticed that an arbitrary origin is accepted. In the screenshot below, you'll see that I added that example origin which was ...
1
vote
2
answers
1k
views
Is my understanding of CSRF, SOP and CORS correct (Express / React)?
I am a hobby developer and am developing an application with a Node JS / Express backend and a React frontend.
I am currently learning about Cross Site Request Forgery (CSRF), and I want to make sure ...
- 11
1
vote
1
answer
460
views
CORS bypass by adding the attacker domain beside the target's domain
When I add a second origin header it is added to the Access-Control-Allow-Origin response header but it adds it with the main domain.
Example:
I intercept the request in burp suite and add this:
...
- 13
2
votes
2
answers
2k
views
String in JSON message body blocked by Azure WAF with OWASP 3.1 returning 403
Details
I have an application running behind an Azure Web Application Firewall (WAF) on an Azure Application Gateway (AppGW) that was previously on an on-premises server. Since moving it to Azure, ...
- 123
1
vote
2
answers
1k
views
Is CSRF token vulnerable if CORS is enabled?
Let's analyze the following scenario:
User authenticates with session cookie
I have CORS enabled (like Access-Control-Allow-Origin: * - header)
I use CSRF Token to prevent CSRF attacks and I include ...
- 113
8
votes
2
answers
2k
views
Security Headers: Access-Control-Allow-Origin vs. Cross-Origin-Resource-Policy (CORP)
Can someone explain the difference between the Access-Control-Allow-Origin header and the Cross-Origin-Resource-Policy header?
According to MDN:
The Access-Control-Allow-Origin response header ...
- 81
-1
votes
1
answer
1k
views
CORS attack using authentication token [closed]
I found a website which is vulnerable to cors.(https://portswigger.net/web-security/cors)
GET /api/requestApiKey HTTP/1.1.
Host: vulnerable-website.com.
Origin: https://evil.com.
AUTHENTICATION: ...
0
votes
1
answer
731
views
Why is Content Security Policy necessary given Same Origin Policy?
Given that Same Origin Policy prevents JavaScript from one origin from running in another origin and accessing another origin's cookies, why is CSP necessary?
Is it that CORS selectively removes some ...
- 514
1
vote
1
answer
3k
views
CORS request is not sending Authorization: Bearer <value> header
When loggin in to a website, A Bearer token is generated and echoed back from the server in a JSON reponse. After this, each request sends the generated token in the Authorization: BEarer header.
...
- 11
7
votes
3
answers
4k
views
Do we need to check for cross-origin on server side?
Modern browsers don't allow cross-origin requests - those must be explicitly allowed by CORS headers. But looking at Java back ends like Tomcat/Spring MVC I see that it's possible to reject requests ...
0
votes
1
answer
139
views
How to get my exploit script served on arbitrary subdomain?
Sometimes when checking whether requests are cross-origin, applications check whether the origin contains the whitelisted domain. This makes it possible to bypass the white-listing by including the ...
- 32.9k
1
vote
1
answer
608
views
What is the difference between Cross Origin Opener Policy and SOP?
"The HTTP Cross-Origin-Opener-Policy (COOP) response header allows you to ensure a top-level document does not share a browsing context group with cross-origin documents."
In a situation ...
- 13
0
votes
1
answer
565
views
Origin header reflected in ACAO header with ACAC set to true on an API
While reviewing an SPA web application the backend API server was reflecting the Origin header from a credentialed request in the Access-Control-Allow-Origin header of the response with Access-Control-...
0
votes
1
answer
1k
views
CORS without Access-Control-Allow-Credentials [duplicate]
I'm testing a web application and burp detected this issue:
Cross-origin resource sharing: arbitrary origin trusted
Looking at the response, I only see this header:
Access-Control-Allow-Origin: https:/...
- 127
0
votes
2
answers
184
views
how to determine CORS Browser state
How do I determine the current CORS "state" in different browsers? I have for example a case where two different Access-Control-Allow-Origin headers are set, and I want to know which one ...
- 118
0
votes
0
answers
114
views
How can I secure an API used for app secret keys without using CORS, created using AWS API gateway?
I am using an API , made using an AWS service named API Gateway [Which may not be of great importance]. I have gone through various articles mentioning that rather than storing secret keys directly on ...
1
vote
2
answers
321
views
What is the use of Access-Control-Allow-Headers for unauthenticated endpoints?
I understand that servers might want to prevent bad origins somehow stealing certain data and crafting a request to request some authorized data from a different domain. Such as using "...
- 141
2
votes
2
answers
5k
views
Difference between `Access-Control-Allow-Origin: *` (wildcard) and specific origins
I have a mostly public API with some parts of it "credentialed" behind cookies, similarly to e.g. how WordPress' REST API works. (In our case, it's a GraphQL API but that shouldn't matter.)
...
- 385
2
votes
1
answer
652
views
CORS configuration for service with single browser client
Please note: although I mention Spring Boot (and by proxy, Java) I believe this is a pure HTTP/web development question at heart, and as such, can be answered by anyone with CORS-configuration ...
- 347
0
votes
1
answer
1k
views
CORS with access-control-allow-credentials
Am I correct in assuming that setting the 'access-control-allow-credentials True' header, even if you are not including the 'access-control-allow-origin' header is potentially dangerous for a website? ...
- 25
1
vote
0
answers
671
views
Should I strip the "Origin" header from client requests?
I'm trying to setup an nginx reverse proxy to a web product I can't modify (it's an appliance).
Client --> https://myapp.com --> nginx --> https://10.1.5.9
I managed to do so, but it ...
- 11
0
votes
2
answers
423
views
Is there an issue if application responds with access control allow origin * but there is no allow credentials header?
Since application is not responding with allow credentials header, an attacker can't craft cross domain request with cookies, but I was wondering if allow origin * alone (Without credentials being ...
- 1
5
votes
1
answer
3k
views
Does CORS interact with WebAssembly the same way it does with Javascript?
Anyone in the WebAppSec world is familiar with CORS as a mechanism to specify policy for when javascript is allowed to make API calls to different domains. As WebAssembly ("Wasm" - a binary ...
- 59.2k
1
vote
2
answers
854
views
Cookie-to-Header CSRF protection vs CORS
What advantages does a Cookie-to-header technique give over CORS in a cross-origin request scenario?
Example scenario:
A rest API called api.com provides data to good.com. api.com has allowlisted ...
1
vote
1
answer
197
views
Can the Origin header have alphabetical port or parameters in a real-life scenario?
I'm testing this application which is properly validating origin header on the sever side. However, if I add any domain and the expect domain as port, application still consider this valid.
Origin: ...
- 11
28
votes
7
answers
16k
views
How do hackers trick frontend validation?
I've always read: Put validations in the backend. Frontend validations are for UX, not security. This is because bad actors can trick frontend validation. But I'm having a hard time wrapping my head ...
0
votes
0
answers
45
views
A potentially simpler same origin policy? [duplicate]
I know there are lots of posts on the same origin policy, but I specifically want to understand why it can't be done in this simpler way.
If evil.com makes sends a request to bank.com, browsers will ...
- 121
0
votes
1
answer
842
views
Permissive CORS - Arbitrary Origin Trust, Remedial Action?
I was completing an assessment for a client and discovered that web application implemented a Permissive CORS policy which allowed for a Arbitrary Origin Trust.
Request:
Host: [REDACTED]
User-agent: ...
- 23
1
vote
1
answer
257
views
Is server side CORS protection enough to mitigate CSRF attacks against stateless APIs?
Assume an Angular SPA application on www.example.com that works invoking an API over that same domain www.example.com/api/...
The Angular app gets a session cookie and sends it in each API call.
The ...
- 217
0
votes
1
answer
295
views
Are there security issues around controlled cross site sharing behind SSO?
Very simply we have a ton of websites at our company behind SSO.
I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get ...
- 118
0
votes
1
answer
216
views
Protecting an external authentication server against CSRF
I have a web application which uses an external authentication server for obtaining a session. When a client tries to login, the browser is making requests towards the external authentication server ...
- 23
0
votes
0
answers
63
views
How can the CSRF happen if browsers do not allow cross-origin requests by default? [duplicate]
How can the CSRF happen if browsers do not allow cross-origin requests by default?
Here is a brief CSRF overview, which is relevant for the question. CSRF (i.e. cross-site request forgery) is a type ...
- 101
1
vote
1
answer
2k
views
Is it safe to add "Access-Control-Allow-Origin:*" to an API endpoint with custom authentication via header?
Lets say I have a site at myapp.com that talks to the api at myapi.com. For that to work I have to turn on CORS. I want to do it like that:
Access-Control-Allow-Origin: *
and my API authentication is ...
- 2,287
0
votes
0
answers
108
views
Secure authentication for sites which allow user to modify js/html
We have a site builder, allows users to add/modify JS/HTML/CSS. Is it possible to provide a global authentication for it?
I mean users login once but can interact with all sites as their own names. ...
- 101