Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Cross-origin resource sharing

Avatar for Dmitry Zhlobo Dmitry Zhlobo
July 02, 2015
Programming
1
74

Cross-origin resource sharing

Avatar for Dmitry Zhlobo

Dmitry Zhlobo

July 02, 2015
Tweet

More Decks by Dmitry Zhlobo

See All by Dmitry Zhlobo
Growing Rails Apps
Avatar for Dmitry Zhlobo dimazhlobo
1
120
Rails: The Good Parts
Avatar for Dmitry Zhlobo dimazhlobo
2
100
Ethereum Smart Contracts For Developers
Avatar for Dmitry Zhlobo dimazhlobo
0
80
Elasticsearch Introduction
Avatar for Dmitry Zhlobo dimazhlobo
0
720
Ruby Code Analisis
Avatar for Dmitry Zhlobo dimazhlobo
7
820

Other Decks in Programming

See All in Programming
Serving TUIs over SSH with Go
Avatar for Carlos Alexandro Becker caarlos0
0
630
flutter_kaigi_mini_4.pdf
Avatar for Hiroki Nobuta nobu74658
0
150
今話題のMCPサーバーをFastAPIでサッと作ってみた
Avatar for Yuuki Shimizu yuukis
0
130
파급효과: From AI to Android Development
Avatar for HyunWoo Lee l2hyunwoo
0
160
Flutterでllama.cppをつかってローカルLLMを試してみた
Avatar for sakuraidayo sakuraidayo
0
140
Bedrock × Confluenceで簡単(?)社内RAG
Avatar for iharuoru iharuoru
1
120
In geheimer Mission: AI Agents entwickeln
Avatar for Jörg Neumann joergneumann
0
110
MySQL初心者が311個のカラムにNot NULL制約を追加していってALTER TABLEについて学んだ話
Avatar for hatsu hatsu38
2
110
Instrumentsを使用した アプリのパフォーマンス向上方法
Avatar for hinakko hinakko
0
240
Dissecting and Reconstructing Ruby Syntactic Structures
Avatar for ydah ydah
4
2.1k
Cursor/Devin全社導入の理想と現実
Avatar for Ryoichi Saito saitoryc
29
22k
バイラテラルアップサンプリング
Avatar for Fadis fadis
3
410

Featured

See All Featured
Large-scale JavaScript Application Architecture
Avatar for Addy Osmani addyosmani
512
110k
Understanding Cognitive Biases in Performance Measurement
Avatar for Philip Tellis bluesmoon
29
1.7k
The Web Performance Landscape in 2024 [PerfNow 2024]
Avatar for Tammy Everts tammyeverts
5
560
Speed Design
Avatar for Sergey Chernyshev sergeychernyshev
29
930
Thoughts on Productivity
Avatar for Jon Yablonski jonyablonski
69
4.6k
Statistics for Hackers
Avatar for Jake VanderPlas jakevdp
799
220k
The World Runs on Bad Software
Avatar for Brandon Keepers bkeepers
PRO
68
11k
Documentation Writing (for coders)
Avatar for Carmen Chung carmenintech
71
4.8k
The Power of CSS Pseudo Elements
Avatar for Geoffrey Crofte geoffreycrofte
75
5.8k
Responsive Adventures: Dirty Tricks From The Dark Corners of Front-End
Avatar for Vitaly Friedman smashingmag
251
21k
Fantastic passwords and where to find them - at NoRuKo
Avatar for Phil Nash philnash
51
3.2k
How to Think Like a Performance Engineer
Avatar for Harry Roberts csswizardry
23
1.6k

Transcript

  1. CORS Cross-origin resource sharing

  2. Whitelist • <script> • <img> • <iframe> • <embed>

  3. But XMLHttpRequest

  4. XSS

  5. Same origin

  6. What to do? • WebSockets • Cross-document messaging • JSONP

    • CORS

  7. JSONP <script src=“http://otherdomain.com/test.json"> callback({"how" : "it works"})

  8. CORS OPTIONS /test.json Host: example.com Origin: http://sbdmn.example.com Access-Control-Allow-Origin: http://sbdmn.example.com Access-Control-Allow-Methods:

    GET, POST

  9. CORS • Request: • Origin • Access-Control-Request-Method • Access-Control-Request-Headers •

    Response: • Access-Control-Allow-Origin • Access-Control-Allow-Credentials • Access-Control-Expose-Headers • Access-Control-Max-Age • Access-Control-Allow-Methods • Access-Control-Allow-Headers

  10. Questions?