Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

Cross-origin resource sharing

Avatar for Dmitry Zhlobo Dmitry Zhlobo
July 02, 2015
Programming
100
1

Cross-origin resource sharing

Avatar for Dmitry Zhlobo

Dmitry Zhlobo

July 02, 2015

More Decks by Dmitry Zhlobo

See All by Dmitry Zhlobo
Growing Rails Apps
Avatar for Dmitry Zhlobo dimazhlobo
1
210
Rails: The Good Parts
Avatar for Dmitry Zhlobo dimazhlobo
2
190
Ethereum Smart Contracts For Developers
Avatar for Dmitry Zhlobo dimazhlobo
0
160
Elasticsearch Introduction
Avatar for Dmitry Zhlobo dimazhlobo
0
800
Ruby Code Analisis
Avatar for Dmitry Zhlobo dimazhlobo
7
890

Other Decks in Programming

See All in Programming
Augmenting AI with the Power of Jakarta EE
Avatar for ivargrimstad ivargrimstad
0
180
まずはコードより業務と向き合う：テーブル解体のためにPdMを呼んだ話
Avatar for さかうぇ sakawe_ee
0
190
自作Discord音声botをLambda MicroVMsに移行した話 / Migrating My Discord Voice Bot to Lambda MicroVMs
Avatar for アキキー | Akihisa Ikeda akihisaikeda
1
300
FactoryBotをやめればRSpecは速くなるのか？
Avatar for nissyi yuta_onishi_97
0
1.6k
SFCで実現する病院・医療システムの動的組み立て式UI
Avatar for kouki.miura koukimiura
1
170
선언형 햅틱 라이브러리 진동을 소개합니다
Avatar for HyunWoo Lee l2hyunwoo
1
300
小さなアプリを作って公開するまで
Avatar for onozaty onozaty
0
140
Crash Auto Pipelines
Avatar for Veronikapj veronikapj
1
390
地方こそサーバーレス — 10年続けた、顔が見えるチームで確かな基盤を / Serverless Matters Most in Regional Areas — 10 Years of Building Reliable Foundations with Close-Knit Teams
Avatar for shiro seike seike460
PRO
1
290
Zero-Tap Sign-In対応、結局何をすればいいの？
Avatar for mitohato14 mitohato14
0
1.8k
私なりのハーネスエンジニアリング ～独自の言語処理系の開発を通して～
Avatar for 瀬尾佳隆 seosoft
0
180
[DroidKnights 2026] Workflow AX: From Auto-Documented Policies to E2E Testing
Avatar for raeminKang raeminkang
0
540

Featured

See All Featured
Prompt Engineering for Job Search
Avatar for Mfonobong Umondia mfonobong
0
580
Building an army of robots
Avatar for Kyle Neath kneath
307
47k
Future Trends and Review - Lecture 12 - Web Technologies (1019888BNR)
Avatar for Beat Signer signer
PRO
0
3.8k
Building a Scalable Design System with Sketch
Avatar for Laura Van Doore lauravandoore
464
34k
DevOps and Value Stream Thinking: Enabling flow, efficiency and business value
Avatar for Helen Beal helenjbeal
2
440
Impact Scores and Hybrid Strategies: The future of link building
Avatar for Tamara Novitovic tamaranovitovic
0
480
The innovator’s Mindset - 
Leading Through an Era of Exponential Change - McGill University 2025
Avatar for Jean-Marc De Jonghe jdejongh
PRO
1
390
GraphQLの誤解/rethinking-graphql
Avatar for sonatard sonatard
75
12k
Fantastic passwords and where to find them - at NoRuKo
Avatar for Phil Nash philnash
53
4k
エンジニアに許された特別な時間の終わり
Avatar for watany watany
109
250k
Highjacked: Video Game Concept Design
Avatar for Ryan Kendrick rkendrick25
PRO
1
550
Fireside Chat
Avatar for paigeccino paigeccino
43
4.1k

Transcript

  1. CORS Cross-origin resource sharing

  2. Whitelist • <script> • <img> • <iframe> • <embed>

  3. But XMLHttpRequest

  4. XSS

  5. Same origin

  6. What to do? • WebSockets • Cross-document messaging • JSONP

    • CORS

  7. JSONP <script src=“http://otherdomain.com/test.json"> callback({"how" : "it works"})

  8. CORS OPTIONS /test.json Host: example.com Origin: http://sbdmn.example.com Access-Control-Allow-Origin: http://sbdmn.example.com Access-Control-Allow-Methods:

    GET, POST

  9. CORS • Request: • Origin • Access-Control-Request-Method • Access-Control-Request-Headers •

    Response: • Access-Control-Allow-Origin • Access-Control-Allow-Credentials • Access-Control-Expose-Headers • Access-Control-Max-Age • Access-Control-Allow-Methods • Access-Control-Allow-Headers

  10. Questions?