4 ms·
In your scenario, the attacker with the web site could simply proxy requests to that CORS "protected" end point (through their own web site, on the back end.) T
by icedchai 5y ago
In your scenario, the attacker with the web site could simply proxy requests to that CORS "protected" end point (through their own web site, on the back end.) That would allow them to read the JSON response, and deliver it to the browser with alternate headers.
- TheCoelacanth 5y agoIn that case, the attacker's endpoint will be on a different domain than your endpoint, so the cookie from your domain won't be included in the request.
- icedchai 5y agoThat is true! But if they find some other vuln that gets them the cookie perhaps the proxy could still be of use.
- TheCoelacanth 5y agoWell, yes, hypothetical vulnerabilities can break any form of security, but without the same-origin policy, they don't even need another vulnerability.