12
votes
How does CORS prevent XSS?
CORS and XSS are related, but not directly. The best way to explain it is by example: we shall consider 3 servers (your_bank.com, api.your_bank.com, badguy.com*) and 1 client (your browser).
You are ...
- 229
11
votes
Accepted
How did the Facebook Originull vulnerablity of Access-Control-Allow-Origin: null allow cross-origin access?
I'm Ysrael and I'm the researcher that found this vulnerability.
Let's divide your question into 2 parts:
A. How did the Origin of the browser become null?
B. How the null Origin affect Facebook ...
- 126
11
votes
Can a website make an HTTP request to "localhost"? How does it get around the cross-domain policy?
Im surprised nobody has pointed out that the accepted answer (by meltdownmonk) is wrong.
"It will not break cross domain policy, because the request will not
cross domains. It will stay local. ...
- 376
11
votes
How does medium.com know my google account?
They do that via an iframe with one of Google's beta features which is currently closed. You can see the iframe in the following screenshot of Medium's website.
However, this does not mean Medium ...
- 111
11
votes
Accepted
How does medium.com know my google account?
Web developers can integrate Google Sign-In with their website.
Google Sign-In manages the OAuth 2.0 flow and token lifecycle, simplifying your integration with Google APIs. A user always has the ...
- 1,634
8
votes
How to implement cross-domain, auto-login SSO without browser redirects for unlogged users?
It seems to me this OpenID Connect scheme should do it. Note though that I'm not a security expert, so don't use it without further confirmation.
User is unlogged to a.com, b.com, sso.com.
User goes ...
- 383
6
votes
How does CORS prevent XSS?
CORS does not protect anything, SOP (Same Origin Policy) protects something instead. SOP protects the target domain and the browser user.
In fact, CORS weaken existing restrictions of SOP to help ...
- 161
6
votes
How to implement cross-domain, auto-login SSO without browser redirects for unlogged users?
The easiest and only way you can do SSO without any redirect at all is if all of your applications run on subdomains (a.site.com, b.site.com). Subdomains can share domain level cookies, so that your ...
- 31.6k
6
votes
Accepted
Is xhr.withCredentials making POST endpoints vulnerable to CSRF?
You don't need an AJAX request, the standard approach to exploit this issue would be:
<form id="myform" method="post" action="http://mysite.vulnerablesite.com/mysite/deleteUser" >
<input ...
- 29.7k
5
votes
How to implement CSRF protection with a cross origin request (CORS)
Our conversation started in the comment section, but I realized some inaccuracies in what I wrote. The sharing of cookies across domains is stricter than I thought at first. This should be a more ...
- 596
5
votes
Why are cookies sent with HTML page's cross domain requests but not with JS's XHR?
Cookies can be send with XHR if withCredentials is set to true. Contrary to cross-origin form submit or the cross-origin include of resources the application has actually control if cookies are sent ...
- 205k
4
votes
How does CORS prevent XSS?
The browser uses SOP (same-origin policy) to protect the user. SOP/CORS does not to protect the services. CORS is a way of the original domain informing the browser that other domains are trusted.
By ...
- 149
3
votes
Automatic's Jetpack login auth....Why isn't this a security flaw?
(Disclaimer: I work for Automattic)
The OP is right to be concerned, because there is something wrong here. But, it's not nearly as bad as it appears on the surface.
WordPress.com is a WordPress ...
- 461
3
votes
Chrome extension: Cross origin request
Actually, they don't even have to inject JavaScript into the main page. Extensions can require permissions to make Cross-Origin requests to certain websites, see https://developer.chrome.com/...
- 131
3
votes
what prevents sending "$.post" from one domain to another?
The --disable-web-security flag will prevent Chromium from enforcing the same-origin policy (SOP), which will allow you to read the response of your cross-origin POST request.
However, do note that ...
- 2,289
3
votes
How did the Facebook Originull vulnerablity of Access-Control-Allow-Origin: null allow cross-origin access?
It's possible to exploit Access-Control-Allow-Origin: null because resources loaded over things like data URI's and sandboxed iframes use the null origin. A PDF documenting the exploit confirms that ...
- 8,844
3
votes
Is CORS helping in anyway against Cross-Site Forgery?
Does it make sense to summarise all this as follows:
SOP (Single Origin Policy) ensures CSRF attacks can't be made from within a modern, up to date, browser due to the fact that the attacker would ...
- 131
3
votes
How to check for cross-domain referrer leakage?
Your browser will add the HTTP Referer header (which, in a sense, indicates the "originating" URL) to most resource requests originating from a web page (exceptions include loading HTTP ...
- 3,996
3
votes
What's the purpose of the preflight check on CORS requests?
In other words, you could skip a preflight check and just rely on the response from the server to dictate whether the request is correct, and this saves the browser from making two requests for the ...
- 205k
3
votes
How to stop app from fetching data from my website?
If some server backend for the app is sending the requests
As I understand it, the requests that fetch data from your website are comming from a server that works as a backend for the offending ...
- 65.7k
3
votes
Accepted
Is there any way to access the contents of a cross domain iframe
Is there any way to access the contents of a cross domain iframe
Not programmatically (see below for another approach), as the same origin policy will not allow this. If it did, that would be cause ...
- 29.7k
3
votes
How to securely set a cookie on another subdomain?
Use an iframe that loads a simple page hosted on learn.example.com that listens for JS message events to pass info between domains. You can trust message.origin, which makes it easy to filter with the ...
- 2,703
2
votes
Access control allow origin browser protection efficiency
It is important to notice that CORS is not around to solve all security issues but rather a specific one which is being able to read data from a third party resource (I am on google.com but I try to ...
- 3,849
2
votes
Accepted
Is a Kerberos ticket valid with only one-way external trust between domains?
from what i gather the IIS server is part of domain A, if so you can add a one way trust between A->B, this will cause all global/universal users in domain B to be trusted by domain A, allowing you to ...
- 731
2
votes
How does CORS prevent XSS?
CORS configuration of your site can allow non-simple requests of your UI to your backend services and at the same time help preventing CSRF (not XSS) (against your site) in case user uses a secure web ...
- 654
2
votes
Security about window.opener and iframes
You are looking for the "sandbox" attribute : https://developer.mozilla.org/en/docs/Web/HTML/Element/iframe
allow-top-navigation: Allows the embedded browsing context to navigate (load) content to ...
- 2,105
2
votes
Cross domain iframe security
I won't give the "how-to" (exploit), but:
You may retrieve cookies (as said in comments, but only non-HTTP-only ones).
You may bypass all CSRF protections (like if they're based on Referer/Origin ...
- 1,371
2
votes
Cross domain iframe security
You could definitely hijack the session by getting cookies, if you can execute the Javascript in that page/frame by sending the message.
Refer : How to send cross domain post request via javascript
...
- 251
2
votes
Accepted
No Preflight Request is made during XHR cross-origin request
A preflight request to check for CORS headers is only done if the request done with XHR could not be achieved without XHR. In your case you are just doing a simple GET request with no special headers ...
- 205k
2
votes
Automatic's Jetpack login auth....Why isn't this a security flaw?
If the domain is hosted by Wordpress, then there is no 'cross domain'; the commenting system is controlled by Wordpress. The domain never sees the credentials.
Can you create a page/widget to collect ...
- 132k
Only top scored, non community-wiki answers of a minimum length are eligible