CORS - Revision history

Rice at 03:26, 5 March 2024

2024-03-05T03:26:43Z

← Older revision		Revision as of 03:26, 5 March 2024
Line 19:		Line 19:
	'''Cross-Origin Resource Sharing''' (CORS) allows server to bypass SOP securely.		'''Cross-Origin Resource Sharing''' (CORS) allows server to bypass SOP securely.

	[[:Category:Cybersecurity]]		[[Category:Cybersecurity]]

Rice: /* What is CORS */

2024-03-05T03:22:38Z

What is CORS

← Older revision		Revision as of 03:22, 5 March 2024
Line 17:		Line 17:

	= What is CORS =		= What is CORS =
	'''Cross-Origin Resource Sharing''' (CORS) allows server		'''Cross-Origin Resource Sharing''' (CORS) allows server to bypass SOP securely.

			[[:Category:Cybersecurity]]

Rice: /* Implementation */

2024-03-03T19:50:26Z

Implementation

← Older revision		Revision as of 19:50, 3 March 2024
Line 3:		Line 3:
	* [https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS Cross-Origin Resource Sharing (CORS) - HTTP \| MDN]		* [https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS Cross-Origin Resource Sharing (CORS) - HTTP \| MDN]

	= Same-origin policy =		= Same-origin policy (SOP) =
	Before talking about CORS, we must first understand a security mechanism called the '''same-origin policy'''~~. This policy restricts how a document or script loaded by one origin can interact with a resource from another origin~~.		Before talking about CORS, we must first understand a security mechanism called the '''same-origin policy'''.

	Two URLs have the same ''origin'' if they have the same protocol, port, and host.		Two URLs have the same ''origin'' if they have the same protocol, port, and host. SOP restricts how a document or script loaded by one origin can interact with a resource from another origin, isolating malicious documents.

	~~This isolates potentially malicious documents.~~ Consider a hacker website ~~with~~ a ~~script that requests resources from our~~ server. ~~Since~~ the hacker website does not have the same origin as us, they can't access our website by the same-origin policy.		Consider a server authenticated via tokens stored in cookies. A hacker website can attempt to make a request to this server with the token stored in the browser cookies. However, since the hacker website does not have the same origin as us, they can't access our website by the same-origin policy.

	==== Implementation ====		==== Implementation ====
	The same origin policy ~~is implemented on the browser. It~~ is built into the ''fetch'' API so that browsers will attach a Origin header to the request.		The same origin policy is built into the browser's ''fetch'' API so that browsers will attach a Origin header to the request. The server will then check that header and confirm that it is from the same origin.

			==== Notes ====
			We can assume that the origin isn't spoofed if and only if the request came from a browser. Anyone can put whatever they want in a request with a curl command. This is not a problem since SOP is intended to protect against other website using your resources (like authentication tokens). Presumably, the wouldn't be able to access your website without these resources.

	= What is CORS =		= What is CORS =
	'''Cross-Origin Resource Sharing''' (CORS) allows server		'''Cross-Origin Resource Sharing''' (CORS) allows server

Rice: /* Same-origin policy */

2024-03-03T18:28:41Z

Same-origin policy

← Older revision		Revision as of 18:28, 3 March 2024
Line 10:		Line 10:
	This isolates potentially malicious documents. Consider a hacker website with a script that requests resources from our server. Since the hacker website does not have the same origin as us, they can't access our website by the same-origin policy.		This isolates potentially malicious documents. Consider a hacker website with a script that requests resources from our server. Since the hacker website does not have the same origin as us, they can't access our website by the same-origin policy.

	~~On the browser side, an HTTP header is attached to identify the origin. There are a series of steps to implement~~ same-origin policy on the ~~server side~~. ~~For more information, see~~ the ~~[https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy#how_to_block_cross-origin_access MDN article] (for my use case, Express~~ ''~~cors~~'' ~~module works fine)~~.		==== Implementation ====
			The same origin policy is implemented on the browser. It is built into the ''fetch'' API so that browsers will attach a Origin header to the request.

	= What is CORS =		= What is CORS =
	'''Cross-Origin Resource Sharing''' (CORS) allows server		'''Cross-Origin Resource Sharing''' (CORS) allows server

Rice: /* Same-origin policy */

2024-03-03T06:23:08Z

Same-origin policy

← Older revision		Revision as of 06:23, 3 March 2024
Line 5:		Line 5:
	= Same-origin policy =		= Same-origin policy =
	Before talking about CORS, we must first understand a security mechanism called the '''same-origin policy'''. This policy restricts how a document or script loaded by one origin can interact with a resource from another origin.		Before talking about CORS, we must first understand a security mechanism called the '''same-origin policy'''. This policy restricts how a document or script loaded by one origin can interact with a resource from another origin.

			Two URLs have the same ''origin'' if they have the same protocol, port, and host.

	This isolates potentially malicious documents. Consider a hacker website with a script that requests resources from our server. Since the hacker website does not have the same origin as us, they can't access our website by the same-origin policy.		This isolates potentially malicious documents. Consider a hacker website with a script that requests resources from our server. Since the hacker website does not have the same origin as us, they can't access our website by the same-origin policy.

	~~==== Define~~. ~~Origin ====~~		On the browser side, an HTTP header is attached to identify the origin. There are a series of steps to implement same-origin policy on the server side. For more information, see the [https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy#how_to_block_cross-origin_access MDN article] (for my use case, Express ''cors'' module works fine).
	~~Two URLs have~~ the ~~same~~ ''~~origin~~'' ~~if they have the same protocol, port, and host~~.

	= What is CORS =		= What is CORS =
	'''Cross-Origin Resource Sharing''' (CORS) allows server		'''Cross-Origin Resource Sharing''' (CORS) allows server

Rice: /* Define. Origin */

2024-03-03T00:45:53Z

Define. Origin

← Older revision		Revision as of 00:45, 3 March 2024
Line 9:		Line 9:

	==== Define. Origin ====		==== Define. Origin ====
			Two URLs have the same ''origin'' if they have the same protocol, port, and host.

	= ~~Overview~~ =		= What is CORS =
	'''Cross-Origin Resource Sharing''' (CORS) allows server		'''Cross-Origin Resource Sharing''' (CORS) allows server

Rice: Created page with "= Sources = * [https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS Cross-Origin Resource Sharing (CORS) - HTTP | MDN] = Same-origin policy = Before talking about CORS, we must first understand a security mechanism called the '''same-origin policy'''. This policy restricts how a document or script loaded by one origin can interact with a resource from another origin. This isolates potentially malicious documents. Consider a hacker website with a script that requests..."

2024-03-03T00:39:42Z

Created page with "= Sources = * [https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS Cross-Origin Resource Sharing (CORS) - HTTP | MDN] = Same-origin policy = Before talking about CORS, we must first understand a security mechanism called the '''same-origin policy'''. This policy restricts how a document or script loaded by one origin can interact with a resource from another origin. This isolates potentially malicious documents. Consider a hacker website with a script that requests..."

New page

= Sources =

* [https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS Cross-Origin Resource Sharing (CORS) - HTTP | MDN]

= Same-origin policy =
Before talking about CORS, we must first understand a security mechanism called the '''same-origin policy'''. This policy restricts how a document or script loaded by one origin can interact with a resource from another origin.

This isolates potentially malicious documents. Consider a hacker website with a script that requests resources from our server. Since the hacker website does not have the same origin as us, they can't access our website by the same-origin policy.

==== Define. Origin ====

= Overview =
'''Cross-Origin Resource Sharing''' (CORS) allows server