Cross-Origin Resource Sharing Flashcards
(20 cards)
True or False
Many web apps don’t connect to each other and are independent from each other’s resources/services.
False
Many web apps connect to each other and rely on each other’s resources/services.
Restricts how a document/script from one origin can interact with a resource from another origin.
Same-Origin Policy
2 web pages have the same origin if they have the same:
- Protocol
- Host/Domain
- Port
A page attempting to interact with a resource from a different origin is making a ___________
Cross-Origin Request
Is this a Cross-Origin Request?
http://myapp.com -> https://myapp.com
Yes, because http is different from https.
- This restriction is done by the browser, not by the website itself.
- Browsers restrict cross-origin HTTP requests initiated within scripts.
Same-Origin Policy
Exceptions
- Embedded requests (
<img src=”...” /><link href=”...” />) - Cross-Origin writes (submitting data to a different origin)
Example:<img src="https://bit.ly/2EZkilW" />
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com /bootstrap/4.1.0/css/bootstrap.min.css" >
Why restrict cross-origin access?
Cross-origin requests are a vector for online attacks. They are a way to steal cookies, and can give an attacker access to a user’s sensitive information if they are not careful.
So they are blocked by default.
______________ is a system that allows resources to be accessed across different origins.
Cross-Origin Resource Sharing (CORS)
True or False
The Access-Control-* headers are used by clients and servers to determine if the client can access the server’s resources.
True
Access-Control-Allow-Origin
Specifies which origins are allowed access
Access-Control-Allow-Credentials
Indicates if sending credentials are allowed
Access-Control-Allow-Methods
Indicates which HTTP methods are allowed to be used for incoming requests
Access-Control-Allow-Headers
Indicates which headers are allowed to be used for incoming requests
Some cross-origin requests trigger a ______________
preflight request
- ______________ are automatically issued by the browser before sending some kinds of cross-origin requests.
- It is a ‘preflight’ check to see if the actual request will be accepted and processed.
Preflight requests
All preflight requests are OPTIONS HTTP requests with 3 particular headers
- Access-Control-Request-Method
- Access-Control-Request-Headers
- Origin
Before the browser sends the actual POST request, it sends an ________ request, to ask if the POST request will be allowed.
OPTIONS
True or False
In general, requests that will cause some sort of change in the server’s data trigger a tralalero tralala.
False
In general, requests that will cause some sort of change in the server’s data trigger a preflight request.
True or False
“Simple” requests don’t trigger a preflight and only look for the Access-Control-Allow-Origin header in the response.
True
