Menu
I see that setting "*" wildcard is security risk i.e.
Access-Control-Allow-Origin: "*"
What i would liked to know are there any security risk in setting of concrete domain i.e.
Access-Control-Allow-Origin: http://www.example.com
273
Access-Control-Allow-Origin: * is totally safe to add to any resource, unless that resource contains private data protected by something other than standard credentials. Standard credentials are cookies, HTTP basic auth, and TLS client certificates.
Common vulnerabilities Because CORS is an access control mechanism, it can be misconfigured, thereby enabling an attacker to bypass it and make the client browser act as a proxy between a malicious website and the target web application.
The Access-Control-Allow-Origin response header indicates whether the response can be shared with requesting code from the given origin.
Run the following command to confirm the origin server returns the Access-Control-Allow-Origin header. Replace example.com with the required origin header. Replace https://www.example.net/video/call/System.generateId.dwr with the URL of the resource that's returning the header error.
CORS headers are typically used for JavaScript AJAX request. Browsers have a built-in safety mechanism that doesn't allow you to query other domains unless they explicitly allow it by setting these CORS headers.
There isn't much of a security risk really. You can always send malicious requests anyway. Browsers just collectively decide to play nice.
One thing to be aware of is that you don't necessarily always want to send the
Access-Control-Allow-Origin: http://www.example.com
header. This could potentially lead people to all the domains that make use of your API. My recommendation is that you only emit the header if it is necessary, ie. you get an OPTIONS request from a whitelisted domain.
I wrote a blog post about this recently: http://fritsvancampen.wordpress.com/2013/02/03/cross-site-origin-requests-aka-cross-origin-resource-sharing/
150
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
