Thread by @sec_r0

#Learn365 - Day 5⃣

CORS Headers. 🤔

What are they ? And how they bypass SOP ?

Learn about them in this thread 🧵👇

#infosec #bugbountytips #CORS #http

In last thread, we talked about SOP, while SOP blocks the response, CORS is use to bypass SOP the most sensible way.

CORS is Cross Origin Resource Sharing.

It allows sharing response across different origins possible. Can we call it Bypassing SOP ?

Yes.

Lets say,

Domain A wants to Talk to Domain B for getting some information.

A

>B

If we go by default, browser will block the response coming from B.

But, if the Server of B Sets CORS headers, then this might be possible.

B will set,
Access-Control-Allow-Origin Header.

And B will set the value of this header

Access-Control-Allow-Origin to A, meaning B is allowing Origin A to access its resource.

So if you see, you are bypassing SOP only with server's permission.

And this Access-Control-Allow-Origin is one of the CORS headers.

There are other CORS headers and something known as PREflight request. Do checkout @PortSwiggerRes blog portswigger.net/web-security/c… to know about this.

Also, you can find more of this information in my SOP Zine. Go check it out on SecurityZines.

Thanks for reading this thread. If you like it, and feel this will be a good share for others, consider Retweeting the thread and following @sec_r0 for more of such security bits.

See you in the next one.