same-origin-policy Questions
7
Solved
If CORS is properly setup on a server to only allow a certain origins to access the server,
Is this enough to prevent CSRF attacks?
Doyen asked 5/11, 2013 at 16:19
4
The command --disable-web-security to allow for cross domain requests on Chrome is no longer working, I presume due to the latest update.
Is there a workaround for this, besides downloading an ol...
Brobdingnagian asked 2/8, 2011 at 20:45
4
Solved
I've been reading up on CORS and how it works, but I'm finding a lot of things confusing. For example, there are lots of details about things like
User Joe is using browser BrowserX to get data...
Mart asked 8/12, 2014 at 19:22
3
When I turn off security entirely in Chrome, it has no effect.
Safari has similar option, it does it.
I would get no CROS error during development of the frontend web app.
I would do it from GUI no...
Lower asked 9/11, 2022 at 11:33
8
For development purposes, I need to disable the same-origin policy in Safari (on Windows) on my machine.
In Chrome, this can be done by launching with the flag --disable-web-security. Is there an ...
Neisse asked 29/12, 2010 at 17:50
6
Solved
How can I allow CORS on Firefox?
I easily managed it on Chrome and Internet Explorer, but I am totally failing at it with Firefox. I edited the following about:config entry
security.fileuri.strict_...
Heavierthanair asked 26/8, 2014 at 11:33
3
Solved
Is "*" or the server's URI the default value for Access-Control-Allow-Origin header?
If the header is not set, does it mean that every origin has access to the resource?
Lamm asked 19/2, 2019 at 16:45
1
For development purposes, I need to disable the Cross-Origin Restrictions in Safari in XCODE's IOS SIMULATOR (iPad) on my iMac.
In Safari on my iMac, this can be done simply by checking 'Disable C...
Lakes asked 20/2, 2017 at 14:15
4
Index.html
<html>
<head>
<script type="module">
import {answer} from './code.js'
console.info("It's ${answer()} time!")
</script>
</head>
<body>
</bo...
Sacksen asked 28/10, 2017 at 17:21
4
Solved
I am creating a sample application using Spring Boot and Angular 7. In spring boot I am converting http to https. In angular application the client side post functionality cannot call the server Ap...
Rogers asked 23/1, 2019 at 13:5
15
Solved
Mod note: This question is about why XMLHttpRequest/fetch/etc. on the browser are subject to the Same Access Policy restrictions (you get errors mentioning CORB or CORS) while Postman is not. This...
Laliberte asked 17/11, 2013 at 19:29
1
Solved
I have a website in which I stored a ton of data in localStorage.
Just now, I have upgraded it to a PWA. Here's my manifest.json:
{
"id": "foo", "name": "bar&quo...
Pilfer asked 16/7, 2023 at 20:19
6
Solved
I've been reading about Access-Control-Allow-Origin because it seems effective at allowing cross domain requests since I have access to the external site. My question ism how do I use Access-Contro...
Morbihan asked 10/8, 2011 at 18:22
4
Solved
When porting my Chrome extension to a Firefox web-extension, I can't make any network requests because they are blocked by the same origin policy.
As an example:
const headers = {"content-type": ...
Inhere asked 2/3, 2018 at 19:13
1
I'm using InAppWebView to make a video downloader app by listening to onLoadResource even and grab the video played by the user and ofc the video inside an iframe and because of cross origin policy...
Garnishee asked 5/2, 2021 at 9:47
15
Solved
I have a problem with the --disable-web-security flag. It is not working in Chrome 48 and Chrome 49 beta on Windows.
I've tried killing all of the instances, reboot and run Chrome with the flag fi...
Isley asked 16/2, 2016 at 12:33
2
I'm trying to do a CORS GET that sends the cookie along with it. I've set all the headers (access-control-allow-origin, access-control-allow-credentials, access-control-allow-headers) in the server...
Mussulman asked 16/9, 2014 at 0:2
1
I want to access https://third-party-url/ from my localhost But chrome is throwing cors error
I am using window 11 and chrome version : Version 106.0.5249.103 which is latest version till 2022-10-1...
Staggers asked 10/10, 2022 at 5:51
2
I am trying to integrate the angualar js app with the backend spring boot , in which i am facing the redirection is not allowed for a preflight request
This is deployed on openshift , i have...
Magnetron asked 13/6, 2019 at 13:26
4
Solved
First of all, I assume a backend that control inputs to prevent XSS vulnerabilities.
In this answer @Les Hazlewood explain how to protect the JWT in the client side.
Assuming 100% TLS for all c...
Conspecific asked 21/10, 2015 at 13:54
1
For development purposes, I had a especially configured Google Chrome shortcut that allowed us to circumvent the same origin policy. This would in turn set a cookie with the result of the query to ...
Baumgardner asked 30/9, 2021 at 10:9
2
Solved
I'm running Cypress tests on https://localhost:3000, which is my CYPRESS_BASE_URL also. Navigating to / redirects to /en internally, which works fine. But the test that I'm writing is about a...
Ulmaceous asked 15/2, 2022 at 19:43
9
Solved
I am loading an <iframe> in my HTML page and trying to access the elements within it using JavaScript, but when I try to execute my code, I get the following error:
SecurityError: Blocked a ...
Keare asked 2/8, 2014 at 18:14
15
Solved
I would like to manipulate the HTML inside an iframe using jQuery.
I thought I'd be able to do this by setting the context of the jQuery function to be the document of the iframe, something like:
...
Parameter asked 13/12, 2008 at 7:20
8
Solved
I'm developing a local research tool that requires me to turn off Firefox's same origin policy (in terms of script access, I don't really care about cross domain requests).
More specifically, I w...
Ovular asked 13/6, 2013 at 13:41
1 Next >
© 2022 - 2025 — McMap. All rights reserved.