https://insinuator.net/tags/cors/ Recent content in CORS on Insinuator.net - Bold Statements Hugo en-us Mon, 26 Aug 2013 00:00:00 +0000 https://insinuator.net/2013/08/some-security-impacts-of-html5-cors-or-how-to-use-a-browser-as-a-proxy/ Mon, 26 Aug 2013 00:00:00 +0000 https://insinuator.net/2013/08/some-security-impacts-of-html5-cors-or-how-to-use-a-browser-as-a-proxy/ <p>With HTML 5 the current web development moves from server side generated content and layout to client side generated. Most of the so called <em>HTML5 powered</em> websites use JavaScript and CSS for generating beautiful looking and responsive user experiences. This ultimately leads to the point were developers want to include or request third-party resources. <em>Un</em>fortunately all current browsers prevent scripts to request external resources through a security feature called the <em>Same-Origin-Policy</em>. This policy specifies that client side code could only request resources from the domain being executed from. This means that a script from example.com can not load a resource from google.com via AJAX(XHR/XmlHttpRequest).</p> https://insinuator.net/2013/08/cross-site-request-forgery-with-cross-origin-resource-sharing/ Fri, 02 Aug 2013 00:00:00 +0000 https://insinuator.net/2013/08/cross-site-request-forgery-with-cross-origin-resource-sharing/ <p>During one of our last projects in a large environment we encountered an interesting flaw. Although it was not possible to exploit it in this particular context, it’s worth to be mentioned here. The finding was about <a href="https://www.owasp.org/index.php/CSRF" title="OWASP CSRF">Cross-Site Request Forgery</a>, a quite well-known attack that forces a user to execute unintended actions within the authenticated context of a web application. With a little help of social engineering (like sending a link via email, chat, embedded code in documents, etc…) an attacker may force the user to execute actions of the attacker’s choice.</p>