Skip to main content

Questions tagged [cors]

Cross Origin Resource Sharing (CORS) lets servers specify what origins can access resources through XHR by setting HTTP headers (e.g. Access-Control-Allow-Origin).

Filter by
Sorted by
Tagged with
18 votes
2 answers
16k views

Vary: origin response header and CORS exploitation

Recently PortSwigger (guys behind Burp Suite) came up with a blog post discussing the security risks associated with CORS mis-configurations. http://blog.portswigger.net/2016/10/exploiting-cors-...
Shurmajee's user avatar
  • 7,467
8 votes
2 answers
6k views

How do I correctly use CORS with OpenID Connect?

There seems to be a number of questions on several blogs, Q&A sites, and comments that ask variants of the question: How do I correctly use CORS with OpenID Connect? The context of these ...
makerofthings7's user avatar
3 votes
1 answer
3k views

How to exploit a misconfigured CORS policy when a per user authorization token is required?

We recently got an API for security audit. The CORS headers of the API seems mis-configured as when we tried requesting the endpoint with http://attacker.com as origin the server returned the ...
StackB00m's user avatar
  • 170
12 votes
3 answers
3k views

What attacks are mitigated by requiring CORS for subresource integrity verification?

Can someone elaborate on the attacks alluded to in this paragraph from the W3C SubResource Integrity spec? In order to mitigate an attacker’s ability to read data cross-origin by brute-forcing ...
ssokolow's user avatar
  • 433
3 votes
0 answers
1k views

In practice, are 3rd party cookies used in Authentication? If they are blocked, what is the UX?

I'm researching the authentication flow in the case that 3rd party cookies are used to authenticate to a website, and are blocked by policy, proxy, or browser settings. It's clear that CORS and ...
makerofthings7's user avatar
2 votes
2 answers
7k views

vuln Cross-origin resource sharing: arbitrary origin trusted

i have some trouble tO exloit CORS respons form burp The application allowed access from the requested origin https://xrmtfgxgjkzw.com request GET wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww....
doglife's user avatar
  • 41
4 votes
4 answers
8k views

do I need to restrict origin in an API app?

I have an app serving a rest-like API and an angular UI for it. Clients can use API directly or use the UI (if client is a human). The app should return special headers as well handle OPTIONS ...
akostadinov's user avatar
10 votes
2 answers
2k views

Is sending "Access-Control-Allow-Origin: http://localhost:8888" dangerous?

I recently found the following HTTP headers on a site that could at the very least be described as a high value target: Access-Control-Allow-Origin: http://localhost:8888 Access-Control-Allow-Methods:...
Anders's user avatar
  • 65.6k
11 votes
1 answer
7k views

Is CORS ever needed during any aspect of OAuth / OpenIDConnect Authentication?

I'm looking at OpenIDConnect authentication and trying to determine if either "simple CORS" or "complex CORS" is ever leveraged during authentication or authorization. Background A Simple CORS (...
makerofthings7's user avatar
6 votes
1 answer
3k views

Does Wordpress REST API with CORS enabled represent a security risk?

After a security inspection of a site running Wordpress with a REST API, the scanner flagged the route /wp-json/ as a vulnerability due to a very flexible CORS policy that allows third parties to ...
r_31415's user avatar
  • 332
5 votes
1 answer
290 views

Would 'zero-knowledge' requests be an secure extension of SOP/CORS?

As far as I understand, the Same Origin Policy exists to prevent authenticated requests from other origins. So when a bad guy builds an evil website which tries to hijack the active authentication of ...
JepZ's user avatar
  • 151
9 votes
2 answers
6k views

How did the Facebook Originull vulnerablity of Access-Control-Allow-Origin: null allow cross-origin access?

Recently, a vulnerability in Facebook's messenger app which allowed attacks to access a users private messages via cross-origin AJAX was patched and disclosed. Simple Bug allows Hackers to Read all ...
Alexander O'Mara's user avatar
3 votes
1 answer
3k views

OAuth2 Implicit Flow: Possible Attack Vectors of Refreshing Token via CORS?

We are currently implementing a Single Page Application (Angular2) and thus have run into the standard "how do we secure our backend API" problem. The standard solution to this apparently to use the ...
donmartin's user avatar
  • 166
3 votes
1 answer
608 views

Is it a security risk that browsers can freely get images (and/or other resources) cross-domain?

Same origin policy protects us from malicious site manipulating the data on our trusted site by not allowing requests that would send the auth cookie e.g. But if I understand correctly images, scripts,...
Ilya Chernomordik's user avatar
3 votes
2 answers
8k views

CORS REST API whitelist

I have a REST API. I want to use this API from multiple web applications. I want to only allow requests from Whitelisted clients. My first point of call would be to add the necessary headers to the ...
OJay's user avatar
  • 133
3 votes
2 answers
4k views

document.cookie and its scope

There is some basic confusion that I have. A non-suspecting victim visits a vulnerable website, vulnerable.com and logs in there. vulnerable.com, post login, sends back a response that has the ...
qre0ct's user avatar
  • 1,522
3 votes
1 answer
519 views

Access control allow origin browser protection efficiency

I was building a website as an experiment, and tried using few ajax requests to different sites. On some sites I will get an error: XMLHttpRequest cannot load http://example.com/path No 'Access-...
t0m9er's user avatar
  • 31
20 votes
2 answers
18k views

Access-control-allow-origin: * with a bearer token

When testing a single page application, I've identified that the REST endpoints return CORS headers that allow cross-domain access: access-control-allow-credentials: true access-control-allow-methods:...
paj28's user avatar
  • 33.5k
83 votes
6 answers
41k views

How does CORS prevent XSS?

I recently learned about CORS and got the impression that its purpose is to prevent XSS. With CORS, the browser blocks requests to different domains, unless particular headers are in place. But if a ...
Gigi's user avatar
  • 1,320
67 votes
7 answers
47k views

Is CORS helping in anyway against Cross-Site Forgery?

I've been reading in the last couple of days about CORS and in a lot of places it's mentioned as it is a "Security" feature to help the world from cross domain forgery. I still don't see the benefit ...
Dan Dinu's user avatar
  • 779
3 votes
1 answer
2k views

Access-Control-Allow-Origin wihout AJAX

This answer (incorrectly?) states No, as long as the CORS Access-Control-Allow-Origin is at its default restrictive value. This prevents the outer website from accessing the framed website via ...
SilverlightFox's user avatar
6 votes
1 answer
2k views

Does returning Access-Control-Allow-Origin: * weaken the security of JSON GET responses?

The W3C CORS recommendation states: Certain types of resources should not attempt to specify particular authorized origins, but instead either deny or allow all origins. ... 3. A GET ...
Matt McClure's user avatar
57 votes
2 answers
88k views

Why is the Access-Control-Allow-Origin header necessary?

I understand the purpose of the Access-Control-Allow-Credentials header, but can't see what problem the Access-Control-Allow-Origin header solves. More precisely, it's easy to see how, if cross-...
Mark Amery's user avatar
  • 1,827
8 votes
1 answer
2k views

Child iFrame hash verification of parent iFrame content

Consider the following scenario: Alice wishes to browse Victor's website while on the job at Initech. Victor's website is hosted on an alternative domain name system to which Initech's DNS does not ...
Indolering's user avatar
10 votes
2 answers
6k views

Is there any risk to enabling CORS with a wildcard on S3?

By default, Amazon S3 blocks cross-origin requests. However, it allows users the ability to set up per-bucket CORS policies. It offers fairly elaborate controls for which domains and methods the user ...
user2719333's user avatar
4 votes
1 answer
7k views

In which ways could a javascript making a cross domain HEAD request be a threat?

I was just reading this answer to the question Why is the same origin policy so important? Basically, when you try to make an XMLHttpRequest to a different domain, the browser will do one of two ...
ian's user avatar
  • 1,302
15 votes
3 answers
4k views

If I never want cross origin requests to be accepted, can I just ignore CORS?

The CORS spec states that if a request method and headers are not simple then a preflight HTTP OPTIONS request is sent to see if the request is allowed by the server. My server does not respond with ...
Jarrod Everett's user avatar

1 2 3
4