On 30/10/2018 18:13, Tom Hughes wrote:
On 30/10/2018 17:36, Mattia Verga wrote:
What type of security issue may arise with a wildcarded
`Access-Control-Allow-Headers: *` header? As I understand CORS, it's not
a server protection, rather a client protection. In fact, installing a
browser extension like CorsE for Firefox easily bypass that "protection"
and allows the script to run.
No it protects against unintended exfiltration of data from
the server - without it a random web page could have javascript
that did a background XHR to a web site that required authentication
and just wait until somebody happens to visit that page who happens
to have a valid session cookie for the target site.
Of course for non-GET requests this extends beyond exfiltration
to state altering operations, so that background script might place
an order or submit a new bug or whatever using your session cookie.
Tom
--
Tom Hughes (tom@xxxxxxxxxx)
http://compton.nu/
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
