/
web app pentesting
/
cross origin resource sharing cors
Menu
Cross-origin resource sharing (CORS)
What is CORS (cross-origin resource sharing)?
Same-origin policy
What is the Same-Origin Policy?
Why is it necessary?
How is the same-origin policy implemented?
Relaxation of the Same-Origin Policy
CORS and the Access-Control-Allow-Origin response header
What is the
Access-Control-Allow-Origin
response header?
Implementing simple cross-origin resource sharing
Handling cross-origin resource requests with credentials
Relaxation of CORS specifications with wildcards
Pre-flight checks
Does CORS protect against CSRF?
Vulnerabilities
Server-generated ACAO header from client-specified Origin header
Errors parsing Origin headers
Whitelisted null origin value
Exploiting XSS via CORS trust relationships
Breaking TLS with poorly configured CORS
Intranets and CORS without credentials
Preventing
