Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Cross-origin resource sharing

Avatar for Dmitry Zhlobo Dmitry Zhlobo
July 02, 2015
Programming
1
74

Cross-origin resource sharing

Avatar for Dmitry Zhlobo

Dmitry Zhlobo

July 02, 2015
Tweet

More Decks by Dmitry Zhlobo

See All by Dmitry Zhlobo
Growing Rails Apps
Avatar for Dmitry Zhlobo dimazhlobo
1
140
Rails: The Good Parts
Avatar for Dmitry Zhlobo dimazhlobo
2
110
Ethereum Smart Contracts For Developers
Avatar for Dmitry Zhlobo dimazhlobo
0
96
Elasticsearch Introduction
Avatar for Dmitry Zhlobo dimazhlobo
0
730
Ruby Code Analisis
Avatar for Dmitry Zhlobo dimazhlobo
7
830

Other Decks in Programming

See All in Programming
クラシルを支える技術と組織
Avatar for raku rakutek
0
180
Reduxモダナイズ　〜コードのモダン化を通して、将来のライブラリ移行に備える〜
Avatar for pvcresin pvcresin
2
630
エンジニアとして高みを目指す、 利益を生み出す設計の考え方 / design-for-profit
Avatar for MinoDriven minodriven
23
11k
CSC305 Lecture 03
Avatar for Javier Gonzalez-Sanchez javiergs
PRO
0
220
大規模アプリのDIフレームワーク刷新戦略 ～過去最大規模の並行開発を止めずにアプリ全体に導入するまで～
Avatar for GO Inc. dev mot_techtalk
0
190
Introducing ReActionView: A new ActionView-Compatible ERB Engine @ Kaigi on Rails 2025, Tokyo, Japan
Avatar for Marco Roth marcoroth
3
650
Swift Concurrency - 状態監視の罠
Avatar for Yuki Yasoshima objectiveaudio
2
260
階層構造を表現するデータ構造とリファクタリング 〜1年で10倍成長したプロダクトの変化と課題〜
Avatar for yuhi yuhisatoxxx
3
740
AIを活用したレシート読み取り機能の開発から得られた実践知 / AI Receipt Scan Practice
Avatar for rockname rockname
2
1.5k
Reactをクライアントで使わない
Avatar for Yusuke Wada yusukebe
7
6.2k
Web技術を最大限活用してRAW画像を現像する / Developing RAW Images on the Web
Avatar for TOMIKAWA Sotaro ssssota
2
960
NetworkXとGNNで学ぶグラフデータ分析入門〜複雑な関係性を解き明かすPythonの力〜
Avatar for みずほリサーチ&テクノロジーズ株式会社 先端技術研究部 mhrtech
3
770

Featured

See All Featured
Fireside Chat
Avatar for paigeccino paigeccino
40
3.7k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
Avatar for soudai sone soudai
PRO
188
55k
Done Done
Avatar for chrislema chrislema
185
16k
GitHub's CSS Performance
Avatar for Jon Rohan jonrohan
1032
460k
Site-Speed That Sticks
Avatar for Harry Roberts csswizardry
10
870
The Success of Rails: Ensuring Growth for the Next 100 Years
Avatar for Eileen M. Uchitelle eileencodes
46
7.6k
Gamification - CAS2011
Avatar for David Bonilla davidbonilla
81
5.4k
Faster Mobile Websites
Avatar for Dean Hume deanohume
310
31k
Helping Users Find Their Own Way: Creating Modern Search Experiences
Avatar for Dan Newman danielanewman
30
2.9k
Building Applications with DynamoDB
Avatar for Matt Wood mza
96
6.6k
Rails Girls Zürich Keynote
Avatar for Gregor Martynus gr2m
95
14k
How To Stay Up To Date on Web Technology
Avatar for Chris Coyier chriscoyier
791
250k

Transcript

  1. CORS Cross-origin resource sharing

  2. Whitelist • <script> • <img> • <iframe> • <embed>

  3. But XMLHttpRequest

  4. XSS

  5. Same origin

  6. What to do? • WebSockets • Cross-document messaging • JSONP

    • CORS

  7. JSONP <script src=“http://otherdomain.com/test.json"> callback({"how" : "it works"})

  8. CORS OPTIONS /test.json Host: example.com Origin: http://sbdmn.example.com Access-Control-Allow-Origin: http://sbdmn.example.com Access-Control-Allow-Methods:

    GET, POST

  9. CORS • Request: • Origin • Access-Control-Request-Method • Access-Control-Request-Headers •

    Response: • Access-Control-Allow-Origin • Access-Control-Allow-Credentials • Access-Control-Expose-Headers • Access-Control-Max-Age • Access-Control-Allow-Methods • Access-Control-Allow-Headers

  10. Questions?