Lesson 2.4: The same-origin policy and CORS
The rule that keeps websites apart inside your browser: the same-origin policy. What an origin is, why another site may send requests to your bank but may not read the answers, and how CORS lets a server relax that rule on purpose. Then the classic mistake: an API that copies any visitor's Origin into its Access-Control-Allow-Origin header and allows cookies, so every website can read a logged-in customer's data. In the lab you find this in the shop's own API, read the PHP line that causes it, fix it, check the syntax and prove the fix with curl.
18 min
You will learn to
- Define an origin and the same-origin policy
- Explain what CORS allows and what it doesn't
- Read Access-Control-* response headers
- Recognise a reflected-origin CORS misconfiguration
- Fix it with an allowlist and prove the fix
Key terms
- Origin
- The scheme, host and port of a page together. Two URLs have the same origin only if all three match.
- Same-origin policy (SOP)
- The browser rule that a script may read responses only from its own origin.
- CORS
- Cross-Origin Resource Sharing: response headers with which a server tells the browser which other origins may read its answers.
- Credentials
- In CORS: cookies and HTTP authentication sent with a cross-origin request. Allowed only with Access-Control-Allow-Credentials: true and a named origin, never with *.
- Preflight
- An OPTIONS request the browser sends first for unusual cross-origin requests (other methods or custom headers), asking the server whether the real request is allowed.
- Allowlist
- A list of exactly what is allowed; everything else is refused.
← MAC addresses, Ethernet and ARP · All lessons · The attack surface: every door into a system →