3 ms·
> CORS protect against the scenario where a malicious site tricks an unmodified browser to make a cross-site request to a legitimate site. If the user has an au
by systemvoltage 5y ago
> CORS protect against the scenario where a malicious site tricks an unmodified browser to make a cross-site request to a legitimate site. If the user has an authentication cookie for the legitimate site, the cookies will be sent along with the request. So the malicious site can perform transactions in the legitimate site on behalf of the user, despite not having direct access to the authentication cookie.
Can you please give an example of this?
- earthboundkid 5y agoYou are logged into example.com and see a page from evil.com in an ad iframe on a third site. Evil.com tells the browser to post example.com/transfer-money?dest=badguy.
- zdragnar 5y agoIt is a solution for AJAX requests to the same problem that CSRF tokens solve for html forms. Imagine a user is logged into facebook, and visits legitimate website X, which has been hacked to inject malicious script Y. Malicious script Y makes a bunch of API calls to Facebook; since the user has been logged in, the Facebook cookies are sent along with the request by the browser. Malicious site Y could delete your posts, make you join pro-Nazi pages, or exfiltrate your network. With CORS in place, the requests would be denied, because API requests can be set up to reject any requests that are not from a specific list of domains. This is a bad example, because Facebook doesnt rely just on cookies, and in fact does have an SDK for making API requests from third party sites. The principle remains, however, if that were not the case, then CORS would be one possible remedy to the problem.