Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Cross-origin resource sharing

Avatar for Dmitry Zhlobo Dmitry Zhlobo
July 02, 2015
Programming
88
1

Cross-origin resource sharing

Avatar for Dmitry Zhlobo

Dmitry Zhlobo

July 02, 2015

More Decks by Dmitry Zhlobo

See All by Dmitry Zhlobo
Growing Rails Apps
Avatar for Dmitry Zhlobo dimazhlobo
1
180
Rails: The Good Parts
Avatar for Dmitry Zhlobo dimazhlobo
2
160
Ethereum Smart Contracts For Developers
Avatar for Dmitry Zhlobo dimazhlobo
0
130
Elasticsearch Introduction
Avatar for Dmitry Zhlobo dimazhlobo
0
770
Ruby Code Analisis
Avatar for Dmitry Zhlobo dimazhlobo
7
870

Other Decks in Programming

See All in Programming
その問い、本当に正しいですか？AI時代のエンジニアに必要な哲学と認知科学 / ai-philosophy-cognitive-science
Avatar for MinoDriven minodriven
14
6.5k
The NotImplementedError Problem in Ruby
Avatar for Koichi ITO koic
1
1k
Creating Composable Callables in Contemporary C++
Avatar for Björn Fahller rollbear
0
180
act1-costs.pdf
Avatar for Sumedh Bala sumedhbala
0
140
正しくソフトウェアを作る、前提を疑うための認知の視点 / doubt-premise
Avatar for MinoDriven minodriven
21
7.2k
Hunting Vulnerabilities in Symfony with LLMs
Avatar for Vincent Amstoutz vinceamstoutz
0
570
Vue × Nuxt × Oxc どこまで使える？実運用の現在地
Avatar for ANDPAD inc andpad
0
330
キャリア迷子上等 ─ "ない道"は自分で作ればいい
Avatar for 16bit_idol 16bitidol
3
2.7k
ローカルLLMでどこまでコードが書けるか -拡張版 /　How much code can be written on a local LLM Extended
Avatar for Naoki Kishida kishida
12
4.6k
これからAgentCoreを触る方へ トレンドはGatewayです
Avatar for Har1101 har1101
6
450
dRuby over BLE
Avatar for makicamel makicamel
2
400
AIを活用したE2Eテスト実装効率化のあゆみ / ebisu-mobile-14-kotetu
Avatar for kotetu (kotetuco) kotetuco
0
150

Featured

See All Featured
No one is an island. Learnings from fostering a developers community.
Avatar for Antonio thoeni
21
3.8k
世界の人気アプリ100個を分析して見えたペイウォール設計の心得
Avatar for Akihiro Kokubo akihiro_kokubo
PRO
72
40k
The Hidden Cost of Media on the Web [PixelPalooza 2025]
Avatar for Tammy Everts tammyeverts
2
340
Prompt Engineering for Job Search
Avatar for Mfonobong Umondia mfonobong
0
360
Why Our Code Smells
Avatar for Brandon Keepers bkeepers
PRO
340
58k
What the history of the web can teach us about the future of AI
Avatar for Ines Montani inesmontani
PRO
1
630
Refactoring Trust on Your Teams (GOTO; Chicago 2020)
Avatar for Rebecca Miller-Webster rmw
35
3.5k
Testing 201, or: Great Expectations
Avatar for Joseph Mastey jmmastey
46
8.2k
Evolving SEO for Evolving Search Engines
Avatar for Ryan Jones ryanjones
0
230
Designing for Performance
Avatar for Lara Hogan lara
611
70k
A designer walks into a library…
Avatar for Paul Jervis Heath pauljervisheath
211
24k
What’s in a name? Adding method to the madness
Avatar for The Alliance productmarketing
PRO
24
4.1k

Transcript

  1. CORS Cross-origin resource sharing

  2. Whitelist • <script> • <img> • <iframe> • <embed>

  3. But XMLHttpRequest

  4. XSS

  5. Same origin

  6. What to do? • WebSockets • Cross-document messaging • JSONP

    • CORS

  7. JSONP <script src=“http://otherdomain.com/test.json"> callback({"how" : "it works"})

  8. CORS OPTIONS /test.json Host: example.com Origin: http://sbdmn.example.com Access-Control-Allow-Origin: http://sbdmn.example.com Access-Control-Allow-Methods:

    GET, POST

  9. CORS • Request: • Origin • Access-Control-Request-Method • Access-Control-Request-Headers •

    Response: • Access-Control-Allow-Origin • Access-Control-Allow-Credentials • Access-Control-Expose-Headers • Access-Control-Max-Age • Access-Control-Allow-Methods • Access-Control-Allow-Headers

  10. Questions?