11 votes
Accepted

How did the Facebook Originull vulnerablity of Access-Control-Allow-Origin: null allow cross-origin access?

I'm Ysrael and I'm the researcher that found this vulnerability. Let's divide your question into 2 parts: A. How did the Origin of the browser become null? B. How the null Origin affect Facebook ...
Ysrael Gurt's user avatar
11 votes

Can a website make an HTTP request to "localhost"? How does it get around the cross-domain policy?

Im surprised nobody has pointed out that the accepted answer (by meltdownmonk) is wrong. "It will not break cross domain policy, because the request will not cross domains. It will stay local. ...
maxeh's user avatar
  • 376
11 votes

How does CORS prevent XSS?

CORS and XSS are related, but not directly. The best way to explain it is by example: we shall consider 3 servers (your_bank.com, api.your_bank.com, badguy.com*) and 1 client (your browser). You are ...
Daniel's user avatar
  • 119
11 votes
Accepted

How does medium.com know my google account?

Web developers can integrate Google Sign-In with their website. Google Sign-In manages the OAuth 2.0 flow and token lifecycle, simplifying your integration with Google APIs. A user always has the ...
Kevin's user avatar
  • 1,663
11 votes

How does medium.com know my google account?

They do that via an iframe with one of Google's beta features which is currently closed. You can see the iframe in the following screenshot of Medium's website. However, this does not mean Medium ...
Justin Massey's user avatar
8 votes

How to implement cross-domain, auto-login SSO without browser redirects for unlogged users?

It seems to me this OpenID Connect scheme should do it. Note though that I'm not a security expert, so don't use it without further confirmation. User is unlogged to a.com, b.com, sso.com. User goes ...
Jan Żankowski's user avatar
6 votes

How does CORS prevent XSS?

CORS does not protect anything, SOP (Same Origin Policy) protects something instead. SOP protects the target domain and the browser user. In fact, CORS weaken existing restrictions of SOP to help ...
Keaser's user avatar
  • 161
6 votes

Cross-domain session standardization

I'm a bit confused about your vernacular. But I'll try. I believe you are using the word "session" to refer to single sign-on (SSO). This is functionality that allows you to sign into one site and ...
Neil Smithline's user avatar
6 votes
Accepted

3rd party API access: Is OAuth really required?

It all comes down to the old adage: "Good IT security is hard". While none of the concerns are known by us here to be fatal (we can't know your whole business and client model), they do raise ...
Stilez's user avatar
  • 1,694
6 votes

How to implement cross-domain, auto-login SSO without browser redirects for unlogged users?

The easiest and only way you can do SSO without any redirect at all is if all of your applications run on subdomains (a.site.com, b.site.com). Subdomains can share domain level cookies, so that your ...
Lie Ryan's user avatar
  • 31.4k
5 votes
Accepted

Accesssing cookies of another domain using Iframes and Javascript

Same Origin Policy ensures that you cannot read or modify the content of a page with different origin. In case of the iframe this means that the parent frame can fully replace the iframe (and thus ...
Steffen Ullrich's user avatar
5 votes
Accepted

Is xhr.withCredentials making POST endpoints vulnerable to CSRF?

You don't need an AJAX request, the standard approach to exploit this issue would be: <form id="myform" method="post" action="http://mysite.vulnerablesite.com/mysite/deleteUser" > <input ...
tim's user avatar
  • 29.6k
5 votes

Why are cookies sent with HTML page's cross domain requests but not with JS's XHR?

Cookies can be send with XHR if withCredentials is set to true. Contrary to cross-origin form submit or the cross-origin include of resources the application has actually control if cookies are sent ...
Steffen Ullrich's user avatar
4 votes

How does CORS prevent XSS?

The browser uses SOP (same-origin policy) to protect the user. SOP/CORS does not to protect the services. CORS is a way of the original domain informing the browser that other domains are trusted. By ...
Micah B.'s user avatar
  • 149
4 votes
Accepted

Would the CORS specification consider a missing Content-Type header to imply a "simple header"?

The main idea behind the content-type restriction is that XMLHttpRequest with CORS should not weaken the default security compared to what already can be done within the traditional security model. ...
Steffen Ullrich's user avatar
4 votes

How to implement CSRF protection with a cross origin request (CORS)

Our conversation started in the comment section, but I realized some inaccuracies in what I wrote. The sharing of cookies across domains is stricter than I thought at first. This should be a more ...
Tobias Bergkvist's user avatar
3 votes
Accepted

No Preflight Request is made during XHR cross-origin request

A preflight request to check for CORS headers is only done if the request done with XHR could not be achieved without XHR. In your case you are just doing a simple GET request with no special headers ...
Steffen Ullrich's user avatar
3 votes

Chrome extension: Cross origin request

Actually, they don't even have to inject JavaScript into the main page. Extensions can require permissions to make Cross-Origin requests to certain websites, see https://developer.chrome.com/...
JacobTDC's user avatar
  • 131
3 votes
Accepted

What are the security implications of enabling CORS for images?

Depends how you set it up. If you allow Cross Origin Requests from any domain, then an attacker who finds the image URLs can do anything you can do within your Javascript application - the security is ...
Matthew's user avatar
  • 27.3k
3 votes

How to check for cross-domain referrer leakage?

Your browser will add the HTTP Referer header (which, in a sense, indicates the "originating" URL) to most resource requests originating from a web page (exceptions include loading HTTP ...
Jedi's user avatar
  • 3,976
3 votes

How did the Facebook Originull vulnerablity of Access-Control-Allow-Origin: null allow cross-origin access?

It's possible to exploit Access-Control-Allow-Origin: null because resources loaded over things like data URI's and sandboxed iframes use the null origin. A PDF documenting the exploit confirms that ...
Alexander O'Mara's user avatar
3 votes

Is CORS helping in anyway against Cross-Site Forgery?

Does it make sense to summarise all this as follows: SOP (Single Origin Policy) ensures CSRF attacks can't be made from within a modern, up to date, browser due to the fact that the attacker would ...
Grub's user avatar
  • 131
3 votes

what prevents sending "$.post" from one domain to another?

The --disable-web-security flag will prevent Chromium from enforcing the same-origin policy (SOP), which will allow you to read the response of your cross-origin POST request. However, do note that ...
rink.attendant.6's user avatar
3 votes

Automatic's Jetpack login auth....Why isn't this a security flaw?

(Disclaimer: I work for Automattic) The OP is right to be concerned, because there is something wrong here. But, it's not nearly as bad as it appears on the surface. WordPress.com is a WordPress ...
Ian Dunn's user avatar
  • 451
3 votes

What's the purpose of the preflight check on CORS requests?

In other words, you could skip a preflight check and just rely on the response from the server to dictate whether the request is correct, and this saves the browser from making two requests for the ...
Steffen Ullrich's user avatar
3 votes

How to stop app from fetching data from my website?

If some server backend for the app is sending the requests As I understand it, the requests that fetch data from your website are comming from a server that works as a backend for the offending ...
Anders's user avatar
  • 65.6k
3 votes
Accepted

Is there any way to access the contents of a cross domain iframe

Is there any way to access the contents of a cross domain iframe Not programmatically (see below for another approach), as the same origin policy will not allow this. If it did, that would be cause ...
tim's user avatar
  • 29.6k
3 votes

How to securely set a cookie on another subdomain?

Use an iframe that loads a simple page hosted on learn.example.com that listens for JS message events to pass info between domains. You can trust message.origin, which makes it easy to filter with the ...
dandavis's user avatar
  • 2,693
2 votes

How does CORS prevent XSS?

CORS configuration of your site can allow non-simple requests of your UI to your backend services and at the same time help preventing CSRF (not XSS) (against your site) in case user uses a secure web ...
akostadinov's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible