CORS in 2023: What's it doing?

CORS (Cross-Origin Resource Sharing) is a mechanism built into most web browsers that prevents a web page from making requests to a different domain than the one that served the web page.

It's built into your browser (on your side of the communication) and is used to protect you while you browse the web.

The basic idea behind CORS is to use HTTP headers to allow a web page from one domain (the "origin" domain) to access resources from another website. CORS has been implemented in all major web browsers for several years and has not changed significantly. However, there may be updates or minor changes to the specific implementation of CORS in different web browsers.

At the request level, CORS works by adding additional HTTP headers to cross-origin HTTP requests.

When a web page from one domain (the "origin" domain) requests a resource from a different domain, the browser automatically adds an Origin header to the request on your behalf. The Origin header contains the origin domain of the web page that made the request.

The server that receives the request can then check the Origin header and decide whether or not to allow the request. The server can do this by looking at the Access-Control-Allow-Origin header in the response.

Suppose the Access-Control-Allow-Origin header in the response contains the origin domain of the request. In that case, the browser will allow the request to continue, and the web page will receive the response.

However, suppose the Access-Control-Allow-Origin header in the response does not contain the origin domain of the request. In that case, the browser will block the request.

To speed things up, CORS also supports the preflight request sent via the HTTP OPTIONS method before the actual request; it allows the browser to check the server's CORS policy before sending the request.

This helps to prevent malicious scripts from making unauthorized requests to other domains on behalf of the user.

CORS can be circumvented in a few ways. However, bypassing CORS creates security risks. Some of the methods include:

1. Using a proxy server: A proxy server can request a different domain on behalf of the web page. This way, the browser will see the proxy server as the origin domain, and the server will see the proxy server as the origin domain, so CORS will not be an issue. A proxy server can record and manipulate data in the middle.
2. Using JSONP: JSONP (JSON with Padding) is a technique that allows web pages to make cross-origin requests by inserting a script tag into the web page that points to the other domain. JSONP can bypass CORS, but it is considered insecure, as it allows the other domain to execute arbitrary code on the web page.
3. Using browser extensions: Some browser extensions can disable CORS restrictions in the browser, but this can also be considered a security risk as it allows malicious scripts to make unauthorized requests to other domains on behalf of the user.

To protect yourself, only use reputable browser extensions and proxy servers, and be cautious of websites that use JSONP.

Additionally, use a browser with built-in security measures like XSS auditor and CSP (Content Security Policy) that can help prevent malicious scripts from making unauthorized requests.

DNSSEC (Domain Name System Security Extensions) is a set of security extensions for the Domain Name System (DNS) that aim to protect against certain types of attacks, such as cache poisoning and DNS spoofing. It does this by adding digital signatures to DNS records, which can be used to verify the authenticity of the DNS records.

DNSSEC and CORS are not directly related, but CORS relies on secure domain names and uncompromised DNS records. They are security mechanisms operating at different levels of the network stack, protecting users from malicious websites.

In Summary

DNSSEC protects the DNS infrastructure, ensuring that the domain name resolution process is secure and that the DNS records returned to the client are authentic. CORS protects web applications, ensuring that web pages from one domain cannot make unauthorized requests to a different site.