Cross-origin resource sharing (CORS) is a mechanism that allows restricted resources on a web page to be requested from another domain outside the domain from which the resource originated. A web page may freely embed images, stylesheets, scripts, iframes, videos and some plugin content (such as Adobe Flash) from any other domain. However embedded web fonts and AJAX (XMLHttpRequest) requests have traditionally been limited to accessing the same domain as the parent web page (as per the same-origin security policy). "Cross-domain" AJAX requests are forbidden by default because of their ability to perform advanced requests (POST, PUT, DELETE and other types of HTTP requests, along with specifying custom HTTP headers) that introduce many cross-site scripting security issues. CORS defines a way in which a browser and server can interact to determine safely whether or not to allow the cross-origin request. It allows for more freedom and functionality than purely same-origin requests, but is more secure than simply allowing all cross-origin requests. It is a recommended standard of the W3C.

1. Cross Origin Resource Sharing
(CORS)
Chathura Weerasooriya 27/04/2016

2. How does Origin differ
• Absolute URI => { protocol, host, port}
http://www.example.com:80/dir2/other.htm
protocol host port

3. Same Origin Policy
• Netscape Navigator 2 in 1995

4. Why Same Origin Policy?
• fabekook.cn can read DOM values from the facebook.com opened in
another tab.
• gmaail.br can read DOM values from the
http://mail.google.com/mail/c/data.. opened in another tab
• For a bank account?

5. Because of this,
• Origin is permitted to send data to another origin. But not to read.
• Cross origin writes Permitted ex: redirects, links, from actions
• Cross origin embedding Permitted ex: html tags with src/href
• Cross origin reads Restricted!!!

6. Why Cross Origin???

8. JSON-P
• JSON {“age” : 42}
• JSONP callback({“age” : 42});
Controller should be changed to return a value as the JSONP type

9. Browser support for CORS

10. CORS

11. CORS
• One way…. web.config file
• Windows Azure has a nice way of doing that

12. References