4 ms·
I must be mistaken because this looks like a nonissue. Servers are not ever expected to trust client provided data. The origin header is optional for non web
by afhof 14y ago
I must be mistaken because this looks like a nonissue. Servers are not ever expected to trust client provided data. The origin header is optional for non web services which means that servers probably won' be too picky about this field. This just looks like the analog to the "Referer" field. Is there a security issue I'm not seeing here?
- arunoda 14y agoNo. There is no security issue. But I just tried to point out that is there any use of Origin header? Or tried to learn if it does something which I didn't get?
- justinschuh 14y agoThe purpose of the origin header in WebSockets is to implement any capabilities that require verification of the requesting origin. This is, of course, valid only in the context of a legitimate client to server connection (since origin security is meaningless in any other context). So, for example, you could use the origin header to protect against confused deputy vulnerabilities (which are known as CSRF in standard HTTP). You could also use the origin header to implement your own cross-origin access control in a scenario where XHR/CORS is not appropriate or efficient (e.g. an embeddable chat widget).
- arunoda 14y agoYes. Now I got it. It does(can be) prevent if CSRF happens. Since Referer header is not sent by all the browsers, Origin can be used. - http://people.mozilla.org/~bsterne/content-security-policy/origin-header-proposal.html http://people.mozilla.org/~bsterne/content-security-policy/o...