Lock in $30 Savings on PRO—Offer Ends Soon! ⏳

Cross-origin resource sharing

Avatar for Dmitry Zhlobo Dmitry Zhlobo
July 02, 2015
Programming
1
75

Cross-origin resource sharing

Avatar for Dmitry Zhlobo

Dmitry Zhlobo

July 02, 2015
Tweet

More Decks by Dmitry Zhlobo

See All by Dmitry Zhlobo
Growing Rails Apps
Avatar for Dmitry Zhlobo dimazhlobo
1
140
Rails: The Good Parts
Avatar for Dmitry Zhlobo dimazhlobo
2
120
Ethereum Smart Contracts For Developers
Avatar for Dmitry Zhlobo dimazhlobo
0
100
Elasticsearch Introduction
Avatar for Dmitry Zhlobo dimazhlobo
0
740
Ruby Code Analisis
Avatar for Dmitry Zhlobo dimazhlobo
7
830

Other Decks in Programming

See All in Programming
組み合わせ爆発にのまれない - 責務分割 x テスト
Avatar for HAL halhorn
1
120
ローターアクトEクラブ アメリカンナイト：川端 柚菜 氏（Japan O.K. ローターアクトEクラブ 会長）:2720 Japan O.K. ロータリーEクラブ2025年12月1日卓話
Avatar for 2720 Japan O.K. ロータリーEクラブ 2720japanoke
0
710
Tinkerbellから学ぶ、Podで DHCPをリッスンする手法
Avatar for Tomofumi Kondo tomokon
0
110
AWS CDKの推しポイントN選
Avatar for アキキー akihisaikeda
1
240
Reactive Thinking with Signals and the new Resource API
Avatar for Manfred Steyer manfredsteyer
PRO
0
170
ゲームの物理 剛体編
Avatar for Fadis fadis
0
290
dnx で実行できるコマンド、作ってみました
Avatar for Tomohisa Takaoka tomohisa
0
140
エディターってAIで操作できるんだぜ
Avatar for kis9a kis9a
0
690
251126 TestState APIってなんだっけ?Step Functionsテストどう変わる?
Avatar for Takumi Abe east_takumi
0
300
CSC509 Lecture 14
Avatar for Javier Gonzalez-Sanchez javiergs
PRO
0
220
NUMA環境とコンテナランタイム ― youki における Linux Memory Policy 実装
Avatar for n4mlz n4mlz
1
210
AIコーディングエージェント（NotebookLM）
Avatar for kondai kondai24
0
150

Featured

See All Featured
The Hidden Cost of Media on the Web [PixelPalooza 2025]
Avatar for Tammy Everts tammyeverts
1
89
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
Avatar for Eileen M. Uchitelle eileencodes
140
34k
Mobile First: as difficult as doing things right
Avatar for Swwweet swwweet
225
10k
Easily Structure & Communicate Ideas using Wireframe
Avatar for Afnizar Nur Ghifari afnizarnur
194
17k
Embracing the Ebb and Flow
Avatar for Simon Collison colly
88
4.9k
The Cost Of JavaScript in 2023
Avatar for Addy Osmani addyosmani
55
9.3k
Done Done
Avatar for chrislema chrislema
186
16k
Balancing Empowerment & Direction
Avatar for Lara Hogan lara
5
790
BBQ
Avatar for Matthew Crist matthewcrist
89
9.9k
Building an army of robots
Avatar for Kyle Neath kneath
306
46k
Large-scale JavaScript Application Architecture
Avatar for Addy Osmani addyosmani
514
110k
Designing Experiences People Love
Avatar for Jonathan Moore moore
143
24k

Transcript

  1. CORS Cross-origin resource sharing

  2. Whitelist • <script> • <img> • <iframe> • <embed>

  3. But XMLHttpRequest

  4. XSS

  5. Same origin

  6. What to do? • WebSockets • Cross-document messaging • JSONP

    • CORS

  7. JSONP <script src=“http://otherdomain.com/test.json"> callback({"how" : "it works"})

  8. CORS OPTIONS /test.json Host: example.com Origin: http://sbdmn.example.com Access-Control-Allow-Origin: http://sbdmn.example.com Access-Control-Allow-Methods:

    GET, POST

  9. CORS • Request: • Origin • Access-Control-Request-Method • Access-Control-Request-Headers •

    Response: • Access-Control-Allow-Origin • Access-Control-Allow-Credentials • Access-Control-Expose-Headers • Access-Control-Max-Age • Access-Control-Allow-Methods • Access-Control-Allow-Headers

  10. Questions?