javascript - How server should respond to the CORS request in case if origin is not in the allowed origins list? -
this question has answer here:
in case client requests not simple html page or javascript server, calls server-side methods.
these method perform activity on server - print documents, store db, etc. server should perform these actions if origin request in list of allowed origins.
otherwise server should response client origin not in allowed origins list.
how correctly? set response header access-control-allow-origin 'null'? or not set access-control-allow-origin header in response @ all?
response code should set in case? 200, 401, ...?
cross origin resource sharing "opt-in", means put cors headers in responses if willing enable it. browsers make little harder attacks if not set cors headers, still need protect backend server against cross-site request forgery (csrf).
you can protect checking referer , origin of request, , denying request, returning forbidden status, example. thing is: browser @ cors headers after issuing request site, if happen modify stuff, happen if tell browser origin not allowed.
the browser may issue options request before sending other dangerous verbs (delete, put, post), betting on browser doing right thing. also, can send http request webserver simple tools curl.
protect backend server other things, issuing commands if request has access token unguessable third parties. if not planning in sharing services other domains, deny request contains cors headers before processing them.
Comments
Post a Comment