Category Archives: same origin policy

what prevents sending "$.post" from one domain to another?

Posted on by

I have one website in chromium tab, and an other website in another tab,
Im executing single post command in the second website – $.post(…); to the first website.
Originaly its not working (getting: “No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin ‘null’ is therefore not allowed access”) ,but if runing chromium with “–disable-web-security –user-data-dir=~/.chrome-tmp ” flags it will send the post.
the question is, what exactly changed so after putting those flags the post is sent ?
I first thought that it disabled “same origin policy” but after some reading it seems like it has nothing to do with it.

Continue reading what prevents sending "$.post" from one domain to another?→

Setting Access-Control-Allow-Origin: * when session identifiers are injected in the HTTP headers

Posted on by

Is it considered as secure for an application to set a header access-control-allow-origin: * if during the normal usage of the application, the client credentials are injected in the headers by the JS code? E.g.:

GET /applic… Continue reading Setting Access-Control-Allow-Origin: * when session identifiers are injected in the HTTP headers→