问题
I'm trying to understand why cross domain requests without credentials is not allowed (by default, without setting up server to return Access-Control-Allow-Origin header). In case of request with credentials all is pretty straightforward - one can fulfill some malicious actions on your behalf on other sites, for example on facebook, if you have logged in on it.
For example this request:
xhr = new XMLHttpRequest();
xhr.open('GET', 'http://www.google.com');
xhr.send();
produce an error ( I executed it in Chrome's console from this site ):
XMLHttpRequest cannot load http://www.google.com/. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://stackoverflow.com' is therefore not allowed access.
So, server must send an appropriate header ( e.g Access-Control-Allow-Origin: * ) to this request can works.
This is just a simple request and no cookie are sent. What's the sense of such a restriction? What security issues might take place if such CORS will be allowed?
without credentials - I mean without sending cookie. Default settings for XMLHTTPRequest is withCredentials = false which means that no cookie are sent in request - link.
回答1:
I'll go ahead and liberally steal from Security.SE's Why is the Access-Control-Allow-Origin header necessary?
The main concern here is access control based on network topology. Suppose you run a HTTP service on your home network (in fact, you almost certainly do, if your router itself has a Web interface). We'll call this service R, and the only machines connected to your home router can get to the service.
When your browser visits evil.example.com, that site serves your browser a script, telling it to fetch the contents of R and send it back to evil.example.com. This is potentially bad, even without credentials, because it's a violation of the assumption that no one outside your local network can view the services running inside your local network. The same-origin policy stops this from happening. If the same-origin policy only came into play when credentials were involved, it would opens up the possibility of bypassing topology-based protections.
Consider also that some public services allow access based on IP address:
- the Oxford English Dictionary restricts access to its online entries to IP addresses coming from subscribed universities
- the United Kingdom restricts access to BBC content to IP address from within the country
In all of the cases listed here, a browser could be used as an unwitting proxy for any site that serves it a script.
来源：https://stackoverflow.com/questions/26306080/why-is-cors-without-credentials-forbidden