This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Talk:Test Cross Origin Resource Sharing (OTG-CLIENT-007)"
From OWASP
Collin Sauve (talk | contribs) |
Collin Sauve (talk | contribs) |
||
| Line 1: | Line 1: | ||
I've removed the bad "Gray Box" examples as they are BOTH bad: | I've removed the bad "Gray Box" examples as they are BOTH bad: | ||
| − | * Example 1 is not an example of an inherently insecure request. Allowing all origins is perfectly fine | + | * Example 1 is not an example of an inherently insecure request. Allowing all origins is perfectly fine unless you also allow credentials. If anyone wants to claim that it is insecure you'll need to justify your reasoning here not just assert it. |
| − | * Example 2 is an XSS problem. The only that that CORS could do here is CORS headers on the | + | * Example 2 is an XSS problem. The only that that CORS could do here is CORS headers on the '''attacker's''' site could mitigate that, which is outside of your control. Just a terrible, terrible example of CORS misconfigurations since the alleged misconfiguration is on the attacker's site. Amazing that this example made it into this wiki in the first place. |
[[User:Collin Sauve|Collin Sauve]] ([[User talk:Collin Sauve|talk]]) 14:33, 25 February 2019 (CST) | [[User:Collin Sauve|Collin Sauve]] ([[User talk:Collin Sauve|talk]]) 14:33, 25 February 2019 (CST) | ||
Revision as of 20:34, 25 February 2019
I've removed the bad "Gray Box" examples as they are BOTH bad:
- Example 1 is not an example of an inherently insecure request. Allowing all origins is perfectly fine unless you also allow credentials. If anyone wants to claim that it is insecure you'll need to justify your reasoning here not just assert it.
- Example 2 is an XSS problem. The only that that CORS could do here is CORS headers on the attacker's site could mitigate that, which is outside of your control. Just a terrible, terrible example of CORS misconfigurations since the alleged misconfiguration is on the attacker's site. Amazing that this example made it into this wiki in the first place.
Collin Sauve (talk) 14:33, 25 February 2019 (CST)
