Ggtcf

I'm currently developing a central AJAX script base for all of our domains (scripts.domain.com).

I have the following PHP code, which in theory would be good protection against bad CORS requests.

$valid_cors = array("domain1","domain2","domain3");
if(in_array($_SERVER['HTTP_ORIGIN'],"https://".$valid_cors)) 
 header('Access-Control-Allow-Origin: https://$valid_cors', false);
 header("Access-Control-Allow-Methods: GET, POST, PUT");
 header("Access-Control-Allow-Headers: Content-Type");

I bet you can guess the message I'm receiving before you even read it. For those of you who can't, it is something along the lines of:

XMLHttpRequest cannot load
https://scripts.domain.com/scripts/ajax_caller.json?.
No 'Access-Control-Allow-Origin' header is present on the requested
resource. Origin 'https://domain1' is therefore not allowed
access.

After reading some questions on here, it is my understanding that most browsers don't even send the HTTP_ORIGIN header, so basically the whole A-C-A-O system is completely pointless, because you've got to then put the Allow-Origin as an asterisk to allow multiple domains to call it. You cannot put multiple A-O headers either, because browsers block the request altogether if there is more than one.

We all know by now - do not trust whatever a browser sends you as it can easily be faked, so why was this ever even considered to be implemented?

It makes no odds to me using the asterisk system because we check against CSRF & session when it is executed before any action files are called, but for most of the users this could seriously do more harm than good putting them into a false sense of security.

Please, can someone tell me I've got the wrong end of the stick here with this and that I'm using it wrong? There doesn't seem to be many people who can give an answer bar asterisk'ing it which makes me even more convinced this is the only way.

After reading some questions on here, it is my understanding that most browsers don't even send the HTTP_ORIGIN header

Well, that's not true. Anything supporting CORS supports sending the Origin request header.

because you've got to then put the Allow-Origin as an asterisk to allow multiple domains to call it

No, that's also not true. Your server can respond differently, based on different origins.

For example, if a request comes in with Origin: a.example.com, then you can respond with Access-Control-Allow-Origin: a.example.com.

If a request comes in with Origin: b.example.com, you respond Access-Control-Allow-Origin: b.example.com.

We all know by now - do not trust whatever a browser sends you as it can easily be faked, so why was this ever even considered to be implemented?

CORS is not for protecting server resources. It's for isolating client access.

As you know, web pages can include data from multiple origins. We do this all the time with images, scripts, etc. However, this only allows for us to see content from multiple origins. It doesn't allow the scripts from multiple origins to see each other's data.

Suppose that wasn't the case... and that you could make cross-domain AJAX requests. Suppose I have a popular blog on investment advice. I know that people reading my blog also probably logged into their brokerage site recently. I could rig a script on my blog site that fires off AJAX requests to the brokerage site to make trades. The reason is that instead of the user making the request, now I'm making the request... but with their cookies. I can impersonate them without them even knowing! Scary stuff.

In a more common example, a lot of home routers have admin panels with the default credentials. A lot of these routers also don't use the proper HTTP verbs... so a GET request can be used to do things like open up ports. These routers are still doomed as I can make a GET request with a simple image tag. Something like this:

<img src="http://192.168.1.1/firewall/?action=openPort&port=22" />

(Of course the "image" will fail to load, but the browser will have made the request and the router will have complied with it.)

If the router used the correct verbs such as PUT or POST, it wouldn't be possible to make this change with a simple image tag. But without CORS, a page could make an AJAX request with a PUT or POST, taking control of your home router without you knowing! Basically, using your machine as a place to run privileged scripts.

Preventing cross-origin access to resources in this way helps keep your privileged access safe.