3 ms·
I think you could implement that with CORS + CSRF tokens (blocking all types of Cross-Origin requests) but the default behaviour is to allow Cross-Origin writes
by anaphor 7y ago
I think you could implement that with CORS + CSRF tokens (blocking all types of Cross-Origin requests) but the default behaviour is to allow Cross-Origin writes (e.g. with form submissions).
See https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy#Cross-origin_network_access https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...
This is why we have CSRF tokens. So that you can effectively block Cross-Origin writes.
- icebraining 7y agoI think pixelperfect is talking about preflights.
- anaphor 7y agoThat makes more sense then. Yes, it will make sure not to send authentication data in that case.
- pixelperfect 7y agoI see what you mean, evil.com could still make a request that includes cookies, which is why we need CSRF tokens. But from my understanding, it wouldn't be able to do that in a XMLHttpRequest hidden on the page. It would have to be a request from something like submitting a form which would navigate the user off the page. Is that correct? Of course it doesn't make much difference from a security perspective.
- anaphor 7y agoYou can work around that by submitting it within an invisible iframe element, e.g. https://stackoverflow.com/a/17953761/903589 https://stackoverflow.com/a/17953761/903589 But yeah, you can't just make arbitrary requests like this with XHR