3 ms·
Is it possible to send a no-cors POST that causes side effects (regardless of the opaque response)? I have only used the DevTools protocol through puppeteer, so
by oefrha 7y ago
Is it possible to send a no-cors POST that causes side effects (regardless of the opaque response)? I have only used the DevTools protocol through puppeteer, so don’t know anything about its authentication. Could it be vulnerable?
- thefreeman 7y agoyour browser will refuse to send the xhr post when the preflight options request does not allow it with CORS headers.
- oefrha 7y agoPOST requests don’t necessarily trigger preflight. But now that I think about it, the DevTools protocol most likely does not accept application/x-www-form-urlencoded, so good point.
- archivist1 7y agoBesides the websocket, the protocol has a couple of HTTP endpoints, you can see commands here: https://cs.chromium.org/chromium/src/content/browser/devtools/devtools_http_handler.cc?q=devtools+agent+http&sq=package:chromium&dr=CSs&l=606 https://cs.chromium.org/chromium/src/content/browser/devtool... which looks like it ignores the HTTP verb and acts only on the path. I confirmed this with tests: fetch('http://localhost:9222/json/new' http://localhost:9222/json/new') and fetch('http://localhost:9222/json/new http://localhost:9222/json/new, {method:'POST', body:''}) do the same thing, as does using verb 'DELETE'. All these open a new tab. Without knowing a 128-bit target identifier, it looks like opening a new tab is the only thing you can do if someone is running DevTools.