Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Cross-origin resource sharing

Avatar for Dmitry Zhlobo Dmitry Zhlobo
July 02, 2015
Programming
1
74

Cross-origin resource sharing

Avatar for Dmitry Zhlobo

Dmitry Zhlobo

July 02, 2015
Tweet

More Decks by Dmitry Zhlobo

See All by Dmitry Zhlobo
Growing Rails Apps
Avatar for Dmitry Zhlobo dimazhlobo
1
140
Rails: The Good Parts
Avatar for Dmitry Zhlobo dimazhlobo
2
120
Ethereum Smart Contracts For Developers
Avatar for Dmitry Zhlobo dimazhlobo
0
97
Elasticsearch Introduction
Avatar for Dmitry Zhlobo dimazhlobo
0
730
Ruby Code Analisis
Avatar for Dmitry Zhlobo dimazhlobo
7
830

Other Decks in Programming

See All in Programming
スキーマ駆動で、Zod OpenAPI Honoによる、API開発するために、Hono Takibiというライブラリを作っている
Avatar for N Akita nakita628
0
270
ソフトウェア設計の実践的な考え方
Avatar for 増田 亨 masuda220
PRO
4
620
Go言語の特性を活かした公式MCP SDKの設計
Avatar for hond hond0413
1
390
Server Side Kotlin Meetup vol.16: 内部動作を理解して ハイパフォーマンスなサーバサイド Kotlin アプリケーションを書こう
Avatar for ternbusty ternbusty
3
230
CSC509 Lecture 05
Avatar for Javier Gonzalez-Sanchez javiergs
PRO
0
310
Writing Better Go: Lessons from 10 Code Reviews
Avatar for Konrad Reiche konradreiche
2
4.8k
品質ワークショップをやってみた
Avatar for Nealle nealle
0
580
Devvox Belgium - Agentic AI Patterns
Avatar for Kevin Dubois kdubois
1
130
overlayPreferenceValue で実現する ピュア SwiftUI な AdMob ネイティブ広告
Avatar for Takashi uhucream
0
200
スマホから Youtube Shortsを見られないようにする
Avatar for lemolatoon lemolatoon
27
33k
AI駆動で0→1をやって見えた光と伸びしろ
Avatar for passion😎 passion0102
1
650
他言語経験者が Golangci-lint を最初のコーディングメンターにした話 / How Golangci-lint Became My First Coding Mentor: A Story from a Polyglot Programmer
Avatar for uMa uma31
0
320

Featured

See All Featured
Six Lessons from altMBA
Avatar for Skipper Chong Warson skipperchong
29
4k
Intergalactic Javascript Robots from Outer Space
Avatar for Vicent Martí tanoku
273
27k
Being A Developer After 40
Avatar for Adrian Kosmaczewski akosma
91
590k
How STYLIGHT went responsive
Avatar for nonsquared nonsquared
100
5.8k
Fashionably flexible responsive web design (full day workshop)
Avatar for Andy Clarke malarkey
407
66k
StorybookのUI Testing Handbookを読んだ
Avatar for Shingo Yamazaki zakiyama
31
6.2k
No one is an island. Learnings from fostering a developers community.
Avatar for Antonio thoeni
21
3.5k
Building Applications with DynamoDB
Avatar for Matt Wood mza
96
6.7k
Designing for humans not robots
Avatar for Tammie Lister tammielis
254
26k
Docker and Python
Avatar for Tania Allard trallard
46
3.6k
The World Runs on Bad Software
Avatar for Brandon Keepers bkeepers
PRO
72
11k
Art, The Web, and Tiny UX
Avatar for Lynn Fisher lynnandtonic
303
21k

Transcript

  1. CORS Cross-origin resource sharing

  2. Whitelist • <script> • <img> • <iframe> • <embed>

  3. But XMLHttpRequest

  4. XSS

  5. Same origin

  6. What to do? • WebSockets • Cross-document messaging • JSONP

    • CORS

  7. JSONP <script src=“http://otherdomain.com/test.json"> callback({"how" : "it works"})

  8. CORS OPTIONS /test.json Host: example.com Origin: http://sbdmn.example.com Access-Control-Allow-Origin: http://sbdmn.example.com Access-Control-Allow-Methods:

    GET, POST

  9. CORS • Request: • Origin • Access-Control-Request-Method • Access-Control-Request-Headers •

    Response: • Access-Control-Allow-Origin • Access-Control-Allow-Credentials • Access-Control-Expose-Headers • Access-Control-Max-Age • Access-Control-Allow-Methods • Access-Control-Allow-Headers

  10. Questions?