HTTPS and HTTP CORS

Question

My questions is simple, but I cannot find an answer and I haven't got any resources to test it myself.

• Can I make HTTPS CORS request from one domain to another HTTPS domain?
• Can I make HTTP CORS request from one domain to another HTTPS domain?

I know that I can do HTTP CORS request from one domain to another HTTP domain, but I don't know if there is any difference when I use HTTPS.

Answer 1

Yes you can do a CORS request from a HTTPS domain to another HTTPS domain.

The only difference is because HTTPS is a secure origin, you can only make call to secure origin, so not to HTTP, the browser will block it with a message like:

Mixed Content: The page at 'https://example.com/index.html' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://example2.com/endpoint'. This request has been blocked; the content must be served over HTTPS.

Warning: If you allow http requests to call your https webpage, it will be insecure because it means an attacker can force requests to your https webpage with the cookies of a victim and read the answer

Answer 2

Beware if you still need to support IE8/IE9 and are using XDomainRequest as it does not support cross-protocol requests. As per MDN:

The origin's security protocol must match that of the requested URL. (http to http, https to https). If these do not match, the request will error "Access is Denied".