3 ms·
It is not useless, because there is information that the browser has and that it is trusted to protect. Consider a server that returns JSON in response to a POS
by jefftk 5y ago
It is not useless, because there is information that the browser has and that it is trusted to protect. Consider a server that returns JSON in response to a POST request, and what JSON it returns depends on the user's cookie. Properly configured CORS headers allow the JSON to be read by some origins and not others.
An attacker with curl will not have the user's cookie and an attacker with a malicious website will not have the right origin.
- icedchai 5y agoIn your scenario, the attacker with the web site could simply proxy requests to that CORS "protected" end point (through their own web site, on the back end.) That would allow them to read the JSON response, and deliver it to the browser with alternate headers.
- TheCoelacanth 5y agoIn that case, the attacker's endpoint will be on a different domain than your endpoint, so the cookie from your domain won't be included in the request.
- icedchai 5y agoThat is true! But if they find some other vuln that gets them the cookie perhaps the proxy could still be of use.
- TheCoelacanth 5y agoWell, yes, hypothetical vulnerabilities can break any form of security, but without the same-origin policy, they don't even need another vulnerability.