Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

Cross-origin resource sharing

Sponsored · Your Podcast. Everywhere. Effortlessly. Share. Educate. Inspire. Entertain. You do you. We'll handle the rest. →
Avatar for Dmitry Zhlobo Dmitry Zhlobo
July 02, 2015
Programming
99
1

Cross-origin resource sharing

Avatar for Dmitry Zhlobo

Dmitry Zhlobo

July 02, 2015

More Decks by Dmitry Zhlobo

See All by Dmitry Zhlobo
Growing Rails Apps
Avatar for Dmitry Zhlobo dimazhlobo
1
200
Rails: The Good Parts
Avatar for Dmitry Zhlobo dimazhlobo
2
180
Ethereum Smart Contracts For Developers
Avatar for Dmitry Zhlobo dimazhlobo
0
160
Elasticsearch Introduction
Avatar for Dmitry Zhlobo dimazhlobo
0
800
Ruby Code Analisis
Avatar for Dmitry Zhlobo dimazhlobo
7
890

Other Decks in Programming

See All in Programming
ActionController meets Protocol Buffers
Avatar for Sorah Fukumori sorah
0
630
Compiling a real-world CLI tool to native with Static Hermes
Avatar for Tzvetan Mikov tmikov2023
0
130
APNsからLive Activityを開始する話
Avatar for Ryotaro Onoue yumnumm
0
170
dotNET_vulnclicker_intro.pdf
Avatar for Tomohiko Morita deka_morita
0
150
Jetpack Compose Mechanisms
Avatar for Jaewoong skydoves
3
840
AWS CDKのカスタムリソースでContinuum（旧Security Agent）を実装した話 | Implementing Continuum (formerly Security Agent) via AWS CDK Custom Resource
Avatar for アキキー | Akihisa Ikeda akihisaikeda
2
160
Kotlinize Is Not Just Converting to Kotlin
Avatar for Kazuki Chigita chigichan24
1
180
IBM Bob Dojo #1 仕様駆動開発入門
Avatar for Akira Onishi (IBM) oniak3ibm
PRO
0
410
GraphQL の onError と Nullability のこれから
Avatar for Yosuke Kurami quramy
0
130
Optunaを作ったときにやりたかったこと、その後 (2026/10/16, Optuna Meetup #3)
Avatar for Takuya Akiba iwiwi
2
1.1k
パスワード再設定メールのURLについて知っておこう
Avatar for uyuki uyuki234
0
170
[Rails World 2026] Durable orchestration on Rails: from continuation to workflow
Avatar for Vladimir Dementyev palkan
1
840

Featured

See All Featured
How to Ace a Technical Interview
Avatar for Jacob Kaplan-Moss jacobian
280
24k
Thoughts on Productivity
Avatar for Jon Yablonski jonyablonski
76
5.4k
A brief & incomplete history of 
UX Design for the World Wide Web: 1989–2019
Avatar for Jason CranfordTeague jct
2
540
Are puppies a ranking factor?
Avatar for Jono Alderson jonoalderson
2
4.1k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
Avatar for soudai sone soudai
PRO
203
77k
End of SEO as We Know It (SMX Advanced Version)
Avatar for Michael King ipullrank
3
4.4k
Tell your own story through comics
Avatar for letsgokoyo letsgokoyo
1
1.1k
Darren the Foodie - Storyboard
Avatar for Kevinho.art khoart
PRO
4
4k
Mozcon NYC 2025: Stop Losing SEO Traffic
Avatar for Sam Torres samtorres
1
580
The Spectacular Lies of Maps
Avatar for Per Axbom axbom
PRO
1
1.1k
Making the Leap to Tech Lead
Avatar for Ryan Cromwell cromwellryan
135
10k
Highjacked: Video Game Concept Design
Avatar for Ryan Kendrick rkendrick25
PRO
1
480

Transcript

  1. CORS Cross-origin resource sharing

  2. Whitelist • <script> • <img> • <iframe> • <embed>

  3. But XMLHttpRequest

  4. XSS

  5. Same origin

  6. What to do? • WebSockets • Cross-document messaging • JSONP

    • CORS

  7. JSONP <script src=“http://otherdomain.com/test.json"> callback({"how" : "it works"})

  8. CORS OPTIONS /test.json Host: example.com Origin: http://sbdmn.example.com Access-Control-Allow-Origin: http://sbdmn.example.com Access-Control-Allow-Methods:

    GET, POST

  9. CORS • Request: • Origin • Access-Control-Request-Method • Access-Control-Request-Headers •

    Response: • Access-Control-Allow-Origin • Access-Control-Allow-Credentials • Access-Control-Expose-Headers • Access-Control-Max-Age • Access-Control-Allow-Methods • Access-Control-Allow-Headers

  10. Questions?