flâneur

Understanding The Web Security Model, Part IV: Cross-Origin Resource Sharing (CORS)

educatedguesswork.org · 3,866 words · saved by 2 readers

This is part IV of my series on the Web security model (parts I, II, outtake, III). In this post, I cover cross-origin resource sharing (CORS), a mechanism for reading data from a different site. As discussed in part III, the Web security model allows sites to import content from another site but generally isolates that content from the importing site. For instance, example.com can pull in an image in from some example.net and display it to the user, but it can't access the contents of the image. This is a necessary security requirement because it prevents attackers from exploiting ambient authority to access sensitive data but it also prevents legitimate uses for cross-origin data, such as a cross-origin API. Consider the case where there is a Web service that has an API, like Wikipedia or Bugzilla, and you want to write a Web application which takes advantage of that API. For instance, suppose I have a little Web service which lets you get the weather at a specific location indicated

Understanding The Web Security Model, Part IV: Cross-Origin Resource Sharing (CORS) Posted by ekr on 19 Apr 2022 This is part IV of my series on the Web security model (parts I , II , outtake , III ). In this post, I cover cross-origin resource sharing (CORS) , a mechanism for reading data from a different site. As discussed in part III , the Web security model allows sites to import content from another site but generally isolates that content from the importing site. For instance, example.com can pull in an image in from some example.net and display it to the user, but it can't access the co

saved by

related reading