Talking to Browsers with CORS
summary
Claims that adding HTTP headers lets a browser-hosted client talk to a separate Python API securely and practically using standard browser behavior. Demonstrates the preflight OPTIONS request, shows required response headers like Access-Control-Allow-Origin: ... plus credentials and exposed headers, and uses a live demo: a ci.github.io client contacting a local OpenStack Ironic API after enabling CORS middleware. Notes star wildcard risks, browser caching of preflight, and that the request can still execute server side even when headers are omitted.
AI-written summary · about
chapters (5)
related talks
37mA Hipster History of CORS
13mCORS: Cross-domain requests with JavaScript
41mHow About a Tour of CORS?
15mNo, It's Not a CORS Error
40mMisconfigured CORS and why web appsec is not getting easier
42mBuilding modular, scalable web apps? of CORS!
38mWhy Do We Need Security Headers?
46mExploiting CORS Misconfigurations for Bitcoins and Bounties