Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Cross-origin resource sharing

Avatar for Dmitry Zhlobo Dmitry Zhlobo
July 02, 2015
Programming
1
74

Cross-origin resource sharing

Avatar for Dmitry Zhlobo

Dmitry Zhlobo

July 02, 2015
Tweet

More Decks by Dmitry Zhlobo

See All by Dmitry Zhlobo
Growing Rails Apps
Avatar for Dmitry Zhlobo dimazhlobo
1
140
Rails: The Good Parts
Avatar for Dmitry Zhlobo dimazhlobo
2
110
Ethereum Smart Contracts For Developers
Avatar for Dmitry Zhlobo dimazhlobo
0
96
Elasticsearch Introduction
Avatar for Dmitry Zhlobo dimazhlobo
0
730
Ruby Code Analisis
Avatar for Dmitry Zhlobo dimazhlobo
7
830

Other Decks in Programming

See All in Programming
アメ車でサンノゼを走ってきたよ！
Avatar for Shigure Shimotori s_shimotori
0
200
iOSエンジニア向けの英語学習アプリを作る！
Avatar for yukawashouhei yukawashouhei
0
180
CSC305 Lecture 02
Avatar for Javier Gonzalez-Sanchez javiergs
PRO
1
260
Reduxモダナイズ　〜コードのモダン化を通して、将来のライブラリ移行に備える〜
Avatar for pvcresin pvcresin
2
690
uniqueパッケージの内部実装を支えるweak pointerの話
Avatar for magavel magavel
0
930
Catch Up: Go Style Guide Update
Avatar for ANDPAD inc andpad
0
200
タスクの特性や不確実性に応じた最適な作業スタイルの選択（ペアプロ・モブプロ・ソロプロ）と実践 / Optimal Work Style Selection: Pair, Mob, or Solo Programming.
Avatar for yuki honyanya
3
140
NetworkXとGNNで学ぶグラフデータ分析入門〜複雑な関係性を解き明かすPythonの力〜
Avatar for みずほリサーチ&テクノロジーズ株式会社 先端技術研究部 mhrtech
3
1.1k
実践AIチャットボットUI実装入門
Avatar for syumai syumai
7
2.5k
私はどうやって技術力を上げたのか
Avatar for Yusuke Wada yusukebe
43
17k
XP, Testing and ninja testing ZOZ5
Avatar for seki at druby.org m_seki
3
360
CSC509 Lecture 03
Avatar for Javier Gonzalez-Sanchez javiergs
PRO
0
330

Featured

See All Featured
Done Done
Avatar for chrislema chrislema
185
16k
Site-Speed That Sticks
Avatar for Harry Roberts csswizardry
11
880
A Tale of Four Properties
Avatar for Chris Coyier chriscoyier
160
23k
Put a Button on it: Removing Barriers to Going Fast.
Avatar for kastner kastner
60
4k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
Avatar for soudai sone soudai
PRO
189
55k
Save Time (by Creating Custom Rails Generators)
Avatar for Garrett Dimon garrettdimon
PRO
32
1.6k
KATA
Avatar for Megan Lloyd mclloyd
32
15k
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
Avatar for Kevin Liebholz kevinliebholz
34
6.1k
Rebuilding a faster, lazier Slack
Avatar for samanthasiow samanthasiow
84
9.2k
How STYLIGHT went responsive
Avatar for nonsquared nonsquared
100
5.8k
Producing Creativity
Avatar for Steve Smith orderedlist
PRO
347
40k
Learning to Love Humans: Emotional Interface Design
Avatar for Aarron Walter aarron
274
40k

Transcript

  1. CORS Cross-origin resource sharing

  2. Whitelist • <script> • <img> • <iframe> • <embed>

  3. But XMLHttpRequest

  4. XSS

  5. Same origin

  6. What to do? • WebSockets • Cross-document messaging • JSONP

    • CORS

  7. JSONP <script src=“http://otherdomain.com/test.json"> callback({"how" : "it works"})

  8. CORS OPTIONS /test.json Host: example.com Origin: http://sbdmn.example.com Access-Control-Allow-Origin: http://sbdmn.example.com Access-Control-Allow-Methods:

    GET, POST

  9. CORS • Request: • Origin • Access-Control-Request-Method • Access-Control-Request-Headers •

    Response: • Access-Control-Allow-Origin • Access-Control-Allow-Credentials • Access-Control-Expose-Headers • Access-Control-Max-Age • Access-Control-Allow-Methods • Access-Control-Allow-Headers

  10. Questions?