February 2018
Beginner to intermediate
426 pages
10h 25m
English
When enabled in a server, the header Access-Control-Allow-Origin is sent in requests. This header tells the client that the server allows requests through XMLHttpRequest from origins (domains and ports) other than the one hosting the application. Having the following header allows requests from any source, making it possible for an attacker to use JavaScript to bypass CSRF protection:
Access-Control-Allow-Origin: *
Read now
Unlock full access