Is CORS a secure way to do cross-domain AJAX requests?

Question

After reading about CORS (Cross-Origin Resource Sharing), I don\'t understand how it improves security. Cross-Domain AJAX communication is allowed if the correct ORIGIN head

Answer 1

You can't fake an Origin header with JavaScript in a web browser. CORS is designed to prevent that.

Outside of a web browser, it doesn't matter. It isn't designed to stop people from getting data that is available to the public. You can't expose it to the public without members of the public getting it.

It is designed so that given:

• Alice, a person providing an API designed to be accessed via Ajax
• Bob, a person with a web browser
• Charlie, a third party running their own website

If Bob visits Charlie's website, then Charlie cannot send JS to Bob's browser so that it fetches data from Alice's website and sends it to Charlie.

The above situation becomes more important if Bob has a user account on Alice's website which allows him to do things like post comments, delete data, or see data that is not available to the general public — since without protection, Charlie's JS could tell Bob's browser to do that behind Bob's back (and then send the results to Charlie).

If you want to stop unauthorized people from seeing the data, then you need to protect it with passwords, SSL client certs or some other means of identity-based authentication/authorization.