jetlib.sec » Full Disclosure » Pros and cons of 'Access-Control-Allow-Origin' header?

Feeds

133122 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

Full Disclosure

• February 22, 2012
• 

  Pros and cons of 'Access-Control-Allow-Origin' header?

  Posted: February 22nd, 2012, 10:37am PST

  Tags:   

  Posted by David Blanc on Feb 22

  Does 'Access-Control-Allow-Origin' header provide any benefits in
  defending against cross site scripting attacks?
  
  Doesn't 'Access-Control-Allow-Origin' header make any XSS flaw
  trivially exploitable? For example, if an attacker finds an XSS flaw
  in a web application, he can now inject a JavaScript with
  XMLHttpRequest that sends a request to attacker's web server which
  serves resources with the HTTP header...