As far as I have known in CORS, browser sends preflight with OPTIONS request to the server to gain approval for the real subsequent GET/POST request. Now, HTTP is sessionless. Is the custom header THE WAY to ensure that the subsequent request is from the same client?

Please view the comment section of the accepted answer to this question: https://stackoverflow.com/questions/33164596/no-access-control-allow-origin-header-is-present-on-the-requested-resource-r/33165599?noredirect=1#comment64474409_33165599


Two things to understand about CORS:

  1. CORS is not for authenticating/approving the client, it is for approving a request originating from code executing within a web page on one origin that is destined to another origin (like JavaScript code on domain1.com making an XmlHttpRequest to domain2.com).

  2. CORS enforcement is entirely client-side. The server does not validate anything.

The client is responsible for asking the web server, "who is allowed to connect to you?". The web server gives it a list (that is the Access-Control-Allow-Origin header) of source origins the client may be "viewing" which are allowed to make requests to it.

The client (browser) checks if the origin it is serving is in the list or matches the wildcard, and if so, it allows the request, otherwise, it blocks it.

I know, generally, it sounds silly to depend on the client for security, but the thing to remember is that CORS is a spec for relaxing the same-origin policy, which is entirely a web browser concept.

Same-origin policy and CORS are meaningless outside the context of web browsers. From a pure HTTP and client/server interaction perspective, there is nothing inherently insecure about making an HTTP request to a web server. Web servers are meant to receive requests. That is their purpose. The same-origin policy is in place to prevent abuse by sandboxing web pages. CORS is a way to allow a browser to play outside of its sandbox in a controlled, safe, revokable manner. The burden is on browsers to enforce it because browsers are the ones who actually care.

  • According to mdn (developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS) server has to respond to the preflight OPTIONS request by sending the headers required. Also, how are the web pages sandboxed and what security implications does it have? – Sudip Bhandari Jul 25 '16 at 13:01
  • 1
    The risk is mainly that if you are logged in to some site with a session, then go to my site, I could write code into my page which makes a request to that other site on your behalf and does whatever. If you're logged into your banking site, my site could issue an HTTP request to transfer funds to my own account, using your credentials. The same origin policy prevents that by putting a sandbox around each "origin". Wikipedia explains it well: en.wikipedia.org/wiki/Same-origin_policy#Security_Concerns – Brandon Jul 25 '16 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.