HTTP - Cross-Origin Request

About

A cross-origin request is a request that was not created by code (html page, javascript, …)) of the same origin.

A page may contain images or other components stored on servers in other domains (for example, ad banners), which performs then cross_origin request and may set third-party cookies. (Used mainly for advertising and tracking across the web)

Method

• What is Cross Origin Resource Sharing (CORS) ?
• window.postMessage() enables cross-origin communication between Window objects.
• This HTML elements are able to create cross-origin request:
  • img,
  • script,
  • and form.

Security

You can prevent bad cross origin request:

• by setting the cors setting on the server level
• by creating a CSRF token for a form.
• by setting the crossorigin attributes on HTML elements
• by controlling that the origin of the request comes from the same origin than when the authentication has occured.

Cookies from the same origin than the destination server are always sent cross-origin to enables user-specific cross-origin APIs

Allowed header

Only the following headers are allowed cross domain:

• Accept
• Accept-Language
• Content-Language
• Last-Event-ID
• Content-Type

any others cause a CORS Pre-flight request.