Skip to content

update cors.md#73

Open
tamimhasan404 wants to merge 1 commit intoEdOverflow:masterfrom
tamimhasan404:patch-3
Open

update cors.md#73
tamimhasan404 wants to merge 1 commit intoEdOverflow:masterfrom
tamimhasan404:patch-3

Conversation

@tamimhasan404
Copy link
Copy Markdown

@tamimhasan404 tamimhasan404 commented May 19, 2021

No description provided.

ItsIgnacioPortal
ItsIgnacioPortal reviewed Jun 7, 2022
View reviewed changes
Comment thread cheatsheets/cors.md

If it is trusting arbitrary origins **with** allow-credentials set to true, then host this HTML as a proof of concept.

## Some method to bypass CORS
Copy link
Copy Markdown

@ItsIgnacioPortal ItsIgnacioPortal Jun 7, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd like to suggest that the title be changed into "Origin-based CORS bypass", to make it more professional

Also, this addition should be below the HTML snippet. Otherwise the document doesn't make sense

@ItsIgnacioPortal
Copy link
Copy Markdown

ItsIgnacioPortal commented Jun 7, 2022

How are these bypasses supposed to be used in the real world? The Origin header cannot be edited by javascript; MDN says that it is a forbidden header

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

3 more reviewers

@ItsIgnacioPortal ItsIgnacioPortal ItsIgnacioPortal left review comments

@its0x08 its0x08 its0x08 approved these changes

@Thaddeus5555555 Thaddeus5555555 Thaddeus5555555 approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@tamimhasan404 @ItsIgnacioPortal @its0x08 @Thaddeus5555555