Comments (4)
Read this first https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
Then small addition from me:
We have [CLIENT] <---> [BROWSER] <---> [SERVER]
Example: We want to request data from CLIENT (http://mysupersite.com) with AJAX on SERVER (http://thirdparty-api.com/hack-the-bank/)
How it was and how it is now:
- XMLHttpRequest v1 - we can't do this with ajax
- XMLHttpRequest v2 - we can do this if server has header (
Access-Control-Allow-Origin: http://mysupersite.com
) and client will send header (Origin: http://mysupersite.com
)
2.1) When user send ajax request browser always add automatically Origin: header with client host
Browser and server perform checks if client can request data:
- server could check that request come with header Origin and if this header contain allowed site could respond with data
- browser check that server respond has header
Access-Control-Allow-Origin: http://mysupersite.com
and allow client to send process request.
to make CORS request client actually do 2 requests:
- Preflighted request https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Preflighted_requests
which ask server if I can request data from it at all, and what METHOD server support.
see also https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/OPTIONS#Preflighted_requests_in_CORS
NOTE: if Preflighted request respond with:
Access-Control-Allow-Origin: http://mysupersite.com
then browser allow to send real request from that address to get data from (SERVER)
- real request will have header
Origin:
So I just intercept requests and response to modify them in extension.
For example we want to get data from server http://server.com on client http://cheater.com, but server allow requests only from http://goodboy.com. When user will send ajax request from cheater.com browser will add automatically Origin: http://cheater.com
In extension I intercept:
- preflight request and respond with
Access-Control-Allow-Origin: http://cheater.com
to fool browser - real request and rewrite
Origin: http://cheater.com
toOrigin: http://goodboy.com
to fool server
PS. server could have additional checks - in this case you will not get response from server
something like this... if I remember it correctly :)
from access-control-allow-origin.
from access-control-allow-origin.
thanks
from access-control-allow-origin.
Could you please copy the answer to Readme.md ?
from access-control-allow-origin.
Related Issues (20)
- Content-Security-Policy (CSP)
- Access-Control-Expose-Headers doesn't work
- Not working
- The 'Access-Control-Allow-Origin' header contains multiple values 'https://mysite.com/path, *', but only one is allowed. HOT 3
- interferes with some websites HOT 7
- Extension forgets the settings after updating the browser
- Don't set the * when the credentials flag is set to true HOT 4
- Name of Chrome plugin is wrong! HOT 2
- Stops working after Chrome restart
- Project needs a defibrillator
- evil.com? HOT 12
- enabled cross site requests after restarting chrome.
- Causes error with facebook HOT 3
- PATCH not working HOT 2
- preflight / options request HOT 1
- Pattern matching not working as expected HOT 2
- The url pattern changes the original address HOT 1
- Restrict the use to specific websites HOT 1
- bc
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from access-control-allow-origin.