Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

Cross-origin resource sharing

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for Dmitry Zhlobo Dmitry Zhlobo
July 02, 2015
Programming
99
1

Cross-origin resource sharing

Avatar for Dmitry Zhlobo

Dmitry Zhlobo

July 02, 2015

More Decks by Dmitry Zhlobo

See All by Dmitry Zhlobo
Growing Rails Apps
Avatar for Dmitry Zhlobo dimazhlobo
1
200
Rails: The Good Parts
Avatar for Dmitry Zhlobo dimazhlobo
2
180
Ethereum Smart Contracts For Developers
Avatar for Dmitry Zhlobo dimazhlobo
0
160
Elasticsearch Introduction
Avatar for Dmitry Zhlobo dimazhlobo
0
800
Ruby Code Analisis
Avatar for Dmitry Zhlobo dimazhlobo
7
890

Other Decks in Programming

See All in Programming
UPDATE をやめる — EF Core でマスタをバージョン管理する
Avatar for HideyukiKitao panda728
PRO
0
1.2k
The Rails Doctrine Decade
Avatar for Koichi ITO koic
2
590
Compiling a real-world CLI tool to native with Static Hermes
Avatar for Tzvetan Mikov tmikov2023
0
120
npm との違いを手がかりにGo の依存管理を理解したい
Avatar for OPTiM optim
0
480
ソニーのクラウド共通基盤の変遷と AI時代の開発スタイルに合わせた進化 / The Journey of Sony’s Common Cloud Platform and Its Evolution for AI-Native Development
Avatar for KenjiYoneyama kenjiyoneyama
0
270
Rでドレミ/Do-Re-Mi_with_R
Avatar for florets1 florets1
0
130
IBM Bob でAI駆動開発『QC-Playbook』
Avatar for 1kano ichirokano2
0
110
気持ちぃ〜角丸 Squircle
Avatar for ryu ryu1013
0
310
KiroのSpecで「五目並べ」を作ってみる
Avatar for Satoshi Kaneyasu satoshi256kbyte
1
380
Railsバージョンを4倍にした話
Avatar for OPTiM optim
0
400
當我們開始不讀 Code - AI Agent 時代，Code Review 與 Clean Code 還剩下什麼？
Avatar for James Wang jame2408
1
230
Unity6 URPによる海底をテーマにしたVJシステムの解説 | Unity Shader 完全に理解した 勉強会
Avatar for がむ gam0022
0
370

Featured

See All Featured
Marketing to machines
Avatar for Jono Alderson jonoalderson
1
5.9k
Understanding Cognitive Biases in Performance Measurement
Avatar for Philip Tellis bluesmoon
32
3.1k
Build The Right Thing And Hit Your Dates
Avatar for Maggie C. maggiecrowley
39
3.5k
VelocityConf: Rendering Performance Case Studies
Avatar for Addy Osmani addyosmani
331
25k
AI: The stuff that nobody shows you
Avatar for John Nunemaker jnunemaker
PRO
10
1.2k
How to audit for AI Accessibility on your Front & Back End
Avatar for davetheseo davetheseo
0
600
GraphQLとの向き合い方2022年版
Avatar for Yosuke Kurami quramy
50
15k
Making Projects Easy
Avatar for Brett Harned brettharned
120
6.8k
Future Trends and Review - Lecture 12 - Web Technologies (1019888BNR)
Avatar for Beat Signer signer
PRO
0
3.8k
DevOps and Value Stream Thinking: Enabling flow, efficiency and business value
Avatar for Helen Beal helenjbeal
2
410
Helping Users Find Their Own Way: Creating Modern Search Experiences
Avatar for Dan Newman danielanewman
31
3.4k
A Tale of Four Properties
Avatar for Chris Coyier chriscoyier
163
24k

Transcript

  1. CORS Cross-origin resource sharing

  2. Whitelist • <script> • <img> • <iframe> • <embed>

  3. But XMLHttpRequest

  4. XSS

  5. Same origin

  6. What to do? • WebSockets • Cross-document messaging • JSONP

    • CORS

  7. JSONP <script src=“http://otherdomain.com/test.json"> callback({"how" : "it works"})

  8. CORS OPTIONS /test.json Host: example.com Origin: http://sbdmn.example.com Access-Control-Allow-Origin: http://sbdmn.example.com Access-Control-Allow-Methods:

    GET, POST

  9. CORS • Request: • Origin • Access-Control-Request-Method • Access-Control-Request-Headers •

    Response: • Access-Control-Allow-Origin • Access-Control-Allow-Credentials • Access-Control-Expose-Headers • Access-Control-Max-Age • Access-Control-Allow-Methods • Access-Control-Allow-Headers

  10. Questions?