Will "Access-Control-Allow-Origin" provide protection if someone directs their domain to my server?

It seems I may have misinterpreted the full implementation of CORS on my server.

Looking at this screenshot of a request made through Chrome.

https://i.sstatic.net/9F1tE.png

We can observe that we are accessing the site shakh.photography, where the request URL is a POST ajax request to /api/get-videos/. However, the response includes an Access-Control-Allow-Origin header referencing a completely different domain.

Despite the webserver including an Access-Control-Allow-Origin header, the browser seems to be ignoring it as everything still functions normally.

I was under the impression that just setting the Access-Control-Allow-Origin would restrict requests to only those from the specified origin.

What am I overlooking?

Until this issue is resolved, users can test the situation by visiting shakh.photography.

javascriptajaxhttp-headersxmlhttprequestcors

Answer №1

The specified request is directed towards the same-origin, specifically shakh.photography/api/, which means that no OPTIONS preflight request is being initiated.

However, if this request were to emanate from a webpage belonging to a third party, like third.party, then the browser would automatically trigger an OPTIONS request. Subsequently, the server would verify its origin policy and likely respond with an error message, since only gamezelle.com is currently permitted. Conversely, if the same request originated from gamezelle.com itself, the response would be positive (OK). Following this acknowledgment, the browser would proceed to submit any further requests as required.

Answer №2

When it comes to the Same Origin Policy, its main purpose is to prevent a website from accessing cross-origin Ajax responses. This serves as a safeguard against unauthorized sites using a user's cookies to extract information from your site under the guise of the user's authorization.

However, CORS offers a way to relax the restrictions imposed by the Same Origin Policy rather than strengthen them.

In an example where we visit shakh.photography and perform a POST ajax request to /api/get-videos/ but receive a response containing an Access-Control-Allow-Origin header pointing to a completely different domain.

Despite the presence of the Access-Control-Allow-Origin header in the web server response, the browser disregards it, and everything continues to function normally.

It is standard practice for a request to originate from Site A and communicate with Site A itself. Any cookies or credentials associated with Site B are kept separate and inaccessible to Site A due to the browser sandboxing them from one another. Essentially, the same data is served for both URLs on the server side.

An external party could attempt this approach, but they would need to host the entire site under a different hostname, which poses minimal security risks. To address this concern, consider configuring your server to utilize Virtual Name Hosting and provide distinct content based on the Host header in the request.

Similar questions

If you have not found the answer to your question or you are interested in this topic, then look at other similar questions below or use the search

Store the output of a mysql query in a variable for future reference

As I work on developing a backend API for a private message system, I have encountered a challenge with one of my functions. The issue arises when I attempt to store the result of an asynchronous call in a variable for future use. Here is the code snippet ...

javascriptmysqlnode.jsexpress

conceal the bootstrap navigation bar while the page is being

Struggling to toggle a Bootstrap navbar on scroll? Need some guidance from the pros out there. I admit, my Bootstrap and jQuery skills are pretty basic. The browser console doesn't throw any errors, and I've experimented with fadeIn, fadeOut, add ...

javascriptjqueryhtmlcsstwitter-bootstrap

Is your Node.js asynchronous parallel function not performing as expected?

I have a series of promises that I need to execute sequentially, but it's getting messy with all the promise returns. To simplify this process, I decided to use the async library and tried out the parallel method. However, instead of running one after ...

javascriptnode.jsasynchronouspromise

Tips for creating incremental progress on a pop-up page?

I am looking for guidance on creating a page with specific functionalities. Here is what I have in mind: I want to implement a button that opens a popup when clicked. The popup should display static instructions and buttons for the user to progress throu ...

javascriptjqueryhtmlajaxpopup

What could be causing my function to execute thrice?

I cannot seem to figure out why my tag cloud is causing the required function to run multiple times instead of just once when I click on a tag. This issue persists whether using jQuery or plain JavaScript. What am I missing? The code I have is very simple, ...

javascriptjqueryhtmlcss

A Guide to Connecting a JavaScript File to an HTML Page with Express and Node.js

Struggling with integrating my JavaScript file into my simple NodeJS app. Traditional methods like placing the script in the header doesn't seem to work with Node. I've attempted using sendFile and other approaches, but none have been successful ...

javascripthtmlnode.js

Comprehending the intricacies of routing within AngularJS

Question: I've been looking into this issue, but there seems to be conflicting answers. I created a simple example in Plunker to understand how routers work in AngularJS, but I'm having trouble getting it to function properly... Below is my inde ...

javascriptangularjsngroute

Step-by-step guide for setting up chartjs on Laravel 6 using npm

Can anyone guide me on how to properly install and integrate [email protected] in my laravel application? Currently, I am using cdn links, but I want to avoid that in the future. List of cdn links being used: <script src="https://cdnjs.c ...

javascriptlaravelnpmchart.jslaravel-charts

Focus on the original control that triggered a jQuery AJAX POST during a postback event

function pageLoad() { $(".VoteUp").live("click", function () { var Id = $(this).attr("index"); d = JSON.stringify({ "Id": Id }) $.ajax({ type: 'POST', url: '../API ...

c#javascriptjqueryasp.netajax

The conditional statement in EJS is not functioning properly

I have been incorporating the ejs template into my express application. Following the guidance on the official page of the template (https://www.npmjs.com/package/ejs), I am utilizing an if conditional to display a variable only if it has been defined. Her ...

javascriptexpressejs

Triggering createEffect in SolidJS with an external dependency: A guide

Is there a way to use an external dependency to trigger the createEffect function in Solid, similar to React's useEffect dependency array? I am trying to execute setShowMenu when there is a change in location.pathname. const location = useLocation() ...

javascriptreactjstypescriptsolid-js

Click on a button to completely remove all JavaScript from your website using jQuery

I'm currently experiencing some difficulties with my website Concept Studio. On a specific page, I have a typing animation within a form and I'd like to include a button that allows users to skip the animation. However, I'm unsure of how to ...

javascriptjquery

Tips for fixing the error "Unhandled error: state.set is not a function"

My code is utilizing immutable.js in the reducer, but I keep encountering an error stating 'state.set is not a function'. Interestingly, when I modify the code to exclude immutable, the error disappears. import React from 'react'; impo ...

javascriptreactjsreduximmutable.jsreducers

Chrome browser not triggering first click event for AJAX jQuery checkbox

My Java application is built with Struts 1.1, utilizing actions, forms, and business objects. To enhance performance, I have integrated AJAX into my code to fetch data quickly and display it in a grid. However, I encountered an issue where clicking on a ch ...

jqueryajax

Using express.js to transfer an uploaded image to Amazon S3

Currently, I am faced with an issue of passing an image uploaded from a react application through express to a managed s3 bucket. The s3 bucket is created and managed by the platform/host I am using, which also generates upload and access urls for me. So f ...

javascriptnode.jsexpressamazon-s3multer

Is the xmlhttprequest timeout/abort feature not functioning as anticipated?

Check out this snippet of my AJAX function: /** * This function initiates an AJAX request * * @param url The URL to call (located in the /ajax/ directory) * @param data The data to send (will be serialized with JSON) * @param callback The fu ...

javascriptajaxiframeconnection-timeout

Calculate the sum of the products when multiplying two values from every array of objects, using Reactjs/Javascript

I'm currently developing an eCommerce application and need to calculate the total price of items that users have ordered. I have an array named 'orders' which contains all the ordered items, each item has two keys - payablePrice and purchase ...

javascriptreactjsecmascript-6

Encountered an error: Unable to access the property 'getTotalLength' from a null value

My SVG animation was functioning perfectly on CodePen. However, when I integrated it into my website, it suddenly stopped working. The console displayed the following error message: Uncaught TypeError: Cannot read property 'getTotalLength' of n ...

javascriptanimationsvgsvg-animate

The error message "Cannot read property 'data' of undefined" is commonly seen in Vue.js when using Axios

I am encountering an issue where the JSON data is not displaying in cards or list format after performing a search. The search functionality appears to be working as I can see the API call with the search text in the console. However, nothing is being disp ...

javascriptjsonvue.jsaxios

Ionic timer binding issue: troubleshooting tips

Recently, I developed a stopwatch factory service that primarily focuses on running. Please disregard the reset and other functionalities as they are not yet implemented. Despite setting up $scope.time to capture timer changes, it doesn't seem to upd ...

javascriptangularjsbindingionic-framework