4 ms·
Simple, if you have an iframe pointing to http://foo.test/deletesite.php http://foo.test/deletesite.php, without cors that request will be done, with cookies an
by tommica 2y ago
Simple, if you have an iframe pointing to http://foo.test/deletesite.php http://foo.test/deletesite.php, without cors that request will be done, with cookies and everything, without the user being aware of it.
- EE84M3i 2y agoAFAIKR you don't need CORS for framing, or making cross origin GET or POST. You only need it to read the response of a cross origin request and setting certain request header and body etc. For example you can make a cross origin GET with an img tag, and a cross-origin POST with a form tag and some JavaScript.
- Thorrez 2y agoYou're correct.
- Thorrez 2y agoThat attack you mention is a CSRF attack. CORS doesn't really protect against that. That exact attack you mention is possible if foo.test doesn't implement CSRF protection. CORS doesn't automatically provide CSRF protection.