Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Cross-origin resource sharing

Sponsored · Ship Features Fearlessly Turn features on and off without deploys. Used by thousands of Ruby developers. →
Avatar for Dmitry Zhlobo Dmitry Zhlobo
July 02, 2015
Programming
81
1

Cross-origin resource sharing

Avatar for Dmitry Zhlobo

Dmitry Zhlobo

July 02, 2015

More Decks by Dmitry Zhlobo

See All by Dmitry Zhlobo
Growing Rails Apps
Avatar for Dmitry Zhlobo dimazhlobo
1
160
Rails: The Good Parts
Avatar for Dmitry Zhlobo dimazhlobo
2
140
Ethereum Smart Contracts For Developers
Avatar for Dmitry Zhlobo dimazhlobo
0
120
Elasticsearch Introduction
Avatar for Dmitry Zhlobo dimazhlobo
0
760
Ruby Code Analisis
Avatar for Dmitry Zhlobo dimazhlobo
7
860

Other Decks in Programming

See All in Programming
アーキテクチャモダナイゼーションとは何か
Avatar for nwiizo nwiizo
19
5.4k
Making the RBS Parser Faster
Avatar for Soutaro Matsumoto soutaro
0
520
「話せることがない」を乗り越える 〜日常業務から登壇テーマをつくる思考法〜
Avatar for ShoheiMitani shoheimitani
4
860
PicoRuby for IoT: Connecting to the Cloud with MQTT
Avatar for Y_uuu yuuu
2
660
Spec-driven Development: How AI Changes Everything (And Nothing)
Avatar for Simon Martinelli simas
PRO
0
250
10年分の技術的負債、完済へ ― Claude Code主導のAI駆動開発でスポーツブルを丸ごとリプレイスした話
Avatar for nero15 takuya_houshima
0
2.6k
AIと共に生きる技術選定 2026
Avatar for Sugar Sato sgash708
0
110
AIを導入する前にやるべきこと
Avatar for Negima negima
2
250
How We Benchmarked Quarkus: Patterns and anti-patterns
Avatar for Holly Cummins hollycummins
1
160
YJITとZJITにはイカなる違いがあるのか？
Avatar for yamanao nakiym
0
250
VueエンジニアがReactを触って感じた_設計の違い
Avatar for kouki.miura koukimiura
0
180
Surviving Black Friday: 329 billion requests with Falcon!
Avatar for Samuel Williams ioquatix
0
830

Featured

See All Featured
エンジニアに許された特別な時間の終わり
Avatar for watany watany
106
240k
How Fast Is Fast Enough? [PerfNow 2025]
Avatar for Tammy Everts tammyeverts
3
540
Writing Fast Ruby
Avatar for Erik Berlin sferik
630
63k
Lightning Talk: Beautiful Slides for Beginners
Avatar for Ines Montani inesmontani
PRO
1
530
Sharpening the Axe: The Primacy of Toolmaking
Avatar for Bryan Cantrill bcantrill
46
2.8k
The B2B funnel & how to create a winning content strategy
Avatar for Katarina Dahlin katarinadahlin
PRO
1
340
職位にかかわらず全員がリーダーシップを発揮するチーム作り / Building a team where everyone can demonstrate leadership regardless of position
Avatar for MADOX madoxten
62
53k
The browser strikes back
Avatar for Jono Alderson jonoalderson
0
990
Efficient Content Optimization with Google Search Console & Apps Script
Avatar for Katarina Dahlin katarinadahlin
PRO
1
510
Exploring the relationship between traditional SERPs and Gen AI search
Avatar for Ray Grieselhuber raygrieselhuber
PRO
2
3.8k
Facilitating Awesome Meetings
Avatar for Lara Hogan lara
57
6.8k
Automating Front-end Workflow
Avatar for Addy Osmani addyosmani
1370
200k

Transcript

  1. CORS Cross-origin resource sharing

  2. Whitelist • <script> • <img> • <iframe> • <embed>

  3. But XMLHttpRequest

  4. XSS

  5. Same origin

  6. What to do? • WebSockets • Cross-document messaging • JSONP

    • CORS

  7. JSONP <script src=“http://otherdomain.com/test.json"> callback({"how" : "it works"})

  8. CORS OPTIONS /test.json Host: example.com Origin: http://sbdmn.example.com Access-Control-Allow-Origin: http://sbdmn.example.com Access-Control-Allow-Methods:

    GET, POST

  9. CORS • Request: • Origin • Access-Control-Request-Method • Access-Control-Request-Headers •

    Response: • Access-Control-Allow-Origin • Access-Control-Allow-Credentials • Access-Control-Expose-Headers • Access-Control-Max-Age • Access-Control-Allow-Methods • Access-Control-Allow-Headers

  10. Questions?