Cross-origin resource sharing

1. CORS Cross-origin resource sharing
2. Whitelist • <script> • <img> • <iframe> • <embed>
3. But XMLHttpRequest
4. XSS
5. Same origin
6. What to do? • WebSockets • Cross-document messaging • JSONP • CORS
7. JSONP <script src=“http://otherdomain.com/test.json"> callback({"how" : "it works"})
8. CORS OPTIONS /test.json Host: example.com Origin: http://sbdmn.example.com Access-Control-Allow-Origin: http://sbdmn.example.com Access-Control-Allow-Methods: GET, POST
9. CORS • Request: • Origin • Access-Control-Request-Method • Access-Control-Request-Headers • Response: • Access-Control-Allow-Origin • Access-Control-Allow-Credentials • Access-Control-Expose-Headers • Access-Control-Max-Age • Access-Control-Allow-Methods • Access-Control-Allow-Headers
10. Questions?