Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Cross-origin resource sharing

Sponsored · Your Podcast. Everywhere. Effortlessly. Share. Educate. Inspire. Entertain. You do you. We'll handle the rest. →
Avatar for Dmitry Zhlobo Dmitry Zhlobo
July 02, 2015
Programming
81
1

Cross-origin resource sharing

Avatar for Dmitry Zhlobo

Dmitry Zhlobo

July 02, 2015

More Decks by Dmitry Zhlobo

See All by Dmitry Zhlobo
Growing Rails Apps
Avatar for Dmitry Zhlobo dimazhlobo
1
160
Rails: The Good Parts
Avatar for Dmitry Zhlobo dimazhlobo
2
140
Ethereum Smart Contracts For Developers
Avatar for Dmitry Zhlobo dimazhlobo
0
120
Elasticsearch Introduction
Avatar for Dmitry Zhlobo dimazhlobo
0
760
Ruby Code Analisis
Avatar for Dmitry Zhlobo dimazhlobo
7
860

Other Decks in Programming

See All in Programming
UIの境界線をデザインする | React Tokyo #15 メイントーク
Avatar for SASAPIYO sasagar
2
400
(Re)make Regexp in Ruby: Democratizing internals for the JIT
Avatar for TSUYUSATO Kitsune makenowjust
3
890
CursorとClaudeCodeとCodexとOpenCodeを実際に比較してみた
Avatar for Terisuke terisuke
1
500
属人化しないコード品質の作り方_2026.04.07.pdf
Avatar for Masaki Murano muraaano
0
270
🦞OpenClaw works with AWS
Avatar for matsukada licux
1
310
10 Tips of AWS ～Gen AI on AWS～
Avatar for matsukada licux
5
500
Kingdom of the Machine
Avatar for yui-knk yui_knk
2
1.2k
Firefoxにコントリビューションして得られた学び
Avatar for ken7253 ken7253
0
110
クラウドネイティブなエンジニアに向ける Raycastの魅力と実際の活用事例
Avatar for Nealle nealle
2
230
実用！Hono RPC2026
Avatar for yodaka yodaka
2
280
Surviving Black Friday: 329 billion requests with Falcon!
Avatar for Samuel Williams ioquatix
0
2k
How We Practice Exploratory Testing in Iterative Development( #scrumniigata ) / 反復開発の中で、探索的テストをどう実施しているか
Avatar for teyamagu teyamagu
PRO
0
140

Featured

See All Featured
Lightning talk: Run Django tests with GitHub Actions
Avatar for Sarah Abderemane sabderemane
0
170
The Mindset for Success: Future Career Progression
Avatar for Greg Gifford greggifford
PRO
0
320
Rails Girls Zürich Keynote
Avatar for Gregor Martynus gr2m
96
14k
A Guide to Academic Writing Using Generative AI - A Workshop
Avatar for Kenji Saito ks91
PRO
1
280
Fight the Zombie Pattern Library - RWD Summit 2016
Avatar for Marcelo Somers marcelosomers
234
17k
Optimizing for Happiness
Avatar for Tom Preston-Werner mojombo
378
71k
SEO in 2025: How to Prepare for the Future of Search
Avatar for Michael King ipullrank
3
3.4k
Claude Code のすすめ
Avatar for schroneko schroneko
67
220k
The Spectacular Lies of Maps
Avatar for Per Axbom axbom
PRO
1
720
Chrome DevTools: State of the Union 2024 - Debugging React & Beyond
Avatar for Addy Osmani addyosmani
10
1.1k
職位にかかわらず全員がリーダーシップを発揮するチーム作り / Building a team where everyone can demonstrate leadership regardless of position
Avatar for MADOX madoxten
62
53k
Collaborative Software Design: How to facilitate domain modelling decisions
Avatar for Kenny Baas-Schwegler baasie
1
200

Transcript

  1. CORS Cross-origin resource sharing

  2. Whitelist • <script> • <img> • <iframe> • <embed>

  3. But XMLHttpRequest

  4. XSS

  5. Same origin

  6. What to do? • WebSockets • Cross-document messaging • JSONP

    • CORS

  7. JSONP <script src=“http://otherdomain.com/test.json"> callback({"how" : "it works"})

  8. CORS OPTIONS /test.json Host: example.com Origin: http://sbdmn.example.com Access-Control-Allow-Origin: http://sbdmn.example.com Access-Control-Allow-Methods:

    GET, POST

  9. CORS • Request: • Origin • Access-Control-Request-Method • Access-Control-Request-Headers •

    Response: • Access-Control-Allow-Origin • Access-Control-Allow-Credentials • Access-Control-Expose-Headers • Access-Control-Max-Age • Access-Control-Allow-Methods • Access-Control-Allow-Headers

  10. Questions?