Questions tagged [crossdomain]
The crossdomain tag has no usage guidance.
9
questions
5
votes
3
answers
7k
views
External cross domain include script
One of my web application underwent a vulnerability assessment recently, and one of the findings is about cross domain include script. Our web app uses addthis_widget.js from AddThis to bookmark ...
- 725
83
votes
6
answers
40k
views
How does CORS prevent XSS?
I recently learned about CORS and got the impression that its purpose is to prevent XSS. With CORS, the browser blocks requests to different domains, unless particular headers are in place.
But if a ...
- 1,310
66
votes
6
answers
45k
views
Is CORS helping in anyway against Cross-Site Forgery?
I've been reading in the last couple of days about CORS and in a lot of places it's mentioned as it is a "Security" feature to help the world from cross domain forgery.
I still don't see the benefit ...
- 769
23
votes
2
answers
57k
views
Can a website make an HTTP request to "localhost"? How does it get around the cross-domain policy?
I found this website which talks about fixing a Redis vulnerability by exploiting that same vulnerability.
The website in question has a "patch me" button, and if you have a password-less Redis ...
- 413
7
votes
2
answers
2k
views
Why are cookies sent with HTML page's cross domain requests but not with JS's XHR?
When we write a HTML page with form tag and an action attribute and a submit button. As soon as we click on submit a request is sent (with cookies) to the URL which was the value of action attribute.
...
- 71
4
votes
1
answer
4k
views
Crossdomain.xml vulnerabilities
<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
<site-control permitted-cross-domain-policies="master-only"/>
</cross-domain-policy>
I would like to ask ...
- 1,590
4
votes
3
answers
3k
views
3rd party API access: Is OAuth really required?
Having a web application with a REST API (say, our-app.com), we want to open our API to 3rd party web applications (say, their-app.com). After some research, having read about OAuth, OpenID Connect, ...
- 255
3
votes
2
answers
1k
views
Will a crossdomain.xml file reduce a potential security risk?
I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
- 6,661
1
vote
1
answer
870
views
Would the CORS specification consider a missing Content-Type header to imply a "simple header"?
RFC 7231, Section 3.1.1.5 states:
A sender that generates a message containing a payload body SHOULD
generate a Content-Type header field in that message unless the
intended media type of the ...
- 400