Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Cross-origin resource sharing

Sponsored · Ship Features Fearlessly Turn features on and off without deploys. Used by thousands of Ruby developers. →
Avatar for Dmitry Zhlobo Dmitry Zhlobo
July 02, 2015
Programming
91
1

Cross-origin resource sharing

Avatar for Dmitry Zhlobo

Dmitry Zhlobo

July 02, 2015

More Decks by Dmitry Zhlobo

See All by Dmitry Zhlobo
Growing Rails Apps
Avatar for Dmitry Zhlobo dimazhlobo
1
190
Rails: The Good Parts
Avatar for Dmitry Zhlobo dimazhlobo
2
170
Ethereum Smart Contracts For Developers
Avatar for Dmitry Zhlobo dimazhlobo
0
140
Elasticsearch Introduction
Avatar for Dmitry Zhlobo dimazhlobo
0
780
Ruby Code Analisis
Avatar for Dmitry Zhlobo dimazhlobo
7
880

Other Decks in Programming

See All in Programming
わからない話を追いかけたら、プログラミング言語を作る側にいた
Avatar for ydah ydah
3
540
書籍「プロフェッショナルAI駆動開発」紹介スライド
Avatar for Juntaro Matsumoto juntaromatsumoto
0
320
AI Engineeringは、AIプロダクトだけのものか？ 〜AIがソフトウェアを作る時代の新しい当たり前〜 / No AI in your product. AI Engineering in your development.
Avatar for r-kagaya rkaga
5
510
為什麼你並不需要ViewModel / No, you don't need a ViewModel
Avatar for Elvis Shi lovee
1
510
AIに既存システムを理解させる技術　～レガシーを見捨てないハーネスエンジニアリング入門～
Avatar for Ochtum ochtum
0
140
関東Kaggler会_NVIDIA_Nemotron_コンペ_振り返り
Avatar for rick rick_ds
0
710
in-process GraphQL のすすめ #ginzajs
Avatar for izumin5210 izumin5210
4
1.5k
Building a Meta Ray-Ban display app
Avatar for Akio Itaya akkeylab
0
180
バグを直したら useEffect が消えた
Avatar for taki colorful12
3
690
仕様駆動開発の消費期限
Avatar for watany watany
20
8.9k
go-spidermonkeyでAIエージェントのCode Modeを実装する
Avatar for syumai syumai
1
760
React本体のコードリーディング
Avatar for high-g high_g_engineer
1
150

Featured

See All Featured
Paper Plane (Part 1)
Avatar for Katie Cordina Lindsey katiecoart
PRO
1
10k
The MySQL Ecosystem @ GitHub 2015
Avatar for Sam Lambert samlambert
251
13k
How to Create Impact in a Changing Tech Landscape [PerfNow 2023]
Avatar for Tammy Everts tammyeverts
56
3.4k
Fireside Chat
Avatar for paigeccino paigeccino
42
4k
sira's awesome portfolio website redesign presentation
Avatar for ElsiraPls elsirapls
0
340
Exploring anti-patterns in Rails
Avatar for Elle Meredith aemeredith
3
470
What the history of the web can teach us about the future of AI
Avatar for Ines Montani inesmontani
PRO
1
660
Amusing Abliteration
Avatar for ianozsvald ianozsvald
1
260
What's in a price? How to price your products and services
Avatar for Michael Herold michaelherold
247
13k
GraphQLとの向き合い方2022年版
Avatar for Yosuke Kurami quramy
50
15k
The agentic SEO stack - context over prompts
Avatar for schlessera schlessera
0
870
SEO for Brand Visibility & Recognition
Avatar for Aleyda Solis aleyda
0
4.7k

Transcript

  1. CORS Cross-origin resource sharing

  2. Whitelist • <script> • <img> • <iframe> • <embed>

  3. But XMLHttpRequest

  4. XSS

  5. Same origin

  6. What to do? • WebSockets • Cross-document messaging • JSONP

    • CORS

  7. JSONP <script src=“http://otherdomain.com/test.json"> callback({"how" : "it works"})

  8. CORS OPTIONS /test.json Host: example.com Origin: http://sbdmn.example.com Access-Control-Allow-Origin: http://sbdmn.example.com Access-Control-Allow-Methods:

    GET, POST

  9. CORS • Request: • Origin • Access-Control-Request-Method • Access-Control-Request-Headers •

    Response: • Access-Control-Allow-Origin • Access-Control-Allow-Credentials • Access-Control-Expose-Headers • Access-Control-Max-Age • Access-Control-Allow-Methods • Access-Control-Allow-Headers

  10. Questions?