Questions tagged [crossdomain]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
5 votes
3 answers

External cross domain include script

One of my web application underwent a vulnerability assessment recently, and one of the findings is about cross domain include script. Our web app uses addthis_widget.js from AddThis to bookmark ...
dorothy's user avatar
  • 725
83 votes
6 answers

How does CORS prevent XSS?

I recently learned about CORS and got the impression that its purpose is to prevent XSS. With CORS, the browser blocks requests to different domains, unless particular headers are in place. But if a ...
Gigi's user avatar
  • 1,310
66 votes
6 answers

Is CORS helping in anyway against Cross-Site Forgery?

I've been reading in the last couple of days about CORS and in a lot of places it's mentioned as it is a "Security" feature to help the world from cross domain forgery. I still don't see the benefit ...
Dan Dinu's user avatar
  • 769
23 votes
2 answers

Can a website make an HTTP request to "localhost"? How does it get around the cross-domain policy?

I found this website which talks about fixing a Redis vulnerability by exploiting that same vulnerability. The website in question has a "patch me" button, and if you have a password-less Redis ...
Daniel Magliola's user avatar
7 votes
2 answers

Why are cookies sent with HTML page's cross domain requests but not with JS's XHR?

When we write a HTML page with form tag and an action attribute and a submit button. As soon as we click on submit a request is sent (with cookies) to the URL which was the value of action attribute. ...
Nix's user avatar
  • 71
4 votes
1 answer

Crossdomain.xml vulnerabilities

<cross-domain-policy> <allow-access-from domain="*" secure="false"/> <site-control permitted-cross-domain-policies="master-only"/> </cross-domain-policy> I would like to ask ...
Michal Koczwara's user avatar
4 votes
3 answers

3rd party API access: Is OAuth really required?

Having a web application with a REST API (say,, we want to open our API to 3rd party web applications (say, After some research, having read about OAuth, OpenID Connect, ...
mh8020's user avatar
  • 255
3 votes
2 answers

Will a crossdomain.xml file reduce a potential security risk?

I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
Bob Ortiz's user avatar
  • 6,661
1 vote
1 answer

Would the CORS specification consider a missing Content-Type header to imply a "simple header"?

RFC 7231, Section states: A sender that generates a message containing a payload body SHOULD generate a Content-Type header field in that message unless the intended media type of the ...
Parker's user avatar
  • 400